CVE-2017-15095

A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaw CVE-2017-7525 by blacklisting more classes that could be used maliciously.

Affected products

Alt Linux, Astra Linux, Debian, Netapp Oncommand Balance, Netapp Oncommand Performance Manager, Netapp Oncommand Shift, Netapp Snapcenter, Oracle Banking Platform

Fasterxml Jackson-databind

< 2.6.7.2, 2.7.9.2, 2.8.10, 2.9.0

CVSS 3.1

9.8 CRITICAL

EPSS

8.4% (95th percentile)

Weakness

CWE-184, CWE-502

NVD status

Modified

Published

2018-02-06