Vulnerability CVE-2017-7525: Information

Description

A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.

Severity: CRITICAL (9.8) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

URL: https://nvd.nist.gov/vuln/detail/CVE-2017-7525

Published: Feb. 6, 2018

Modified: Nov. 7, 2023

Error type identifier: CWE-184

Fixed packages

Package name	Branch	Fixed in version	Version from repository	Errata ID	Task #	State
jackson-databind	sisyphus	2.9.4-alt1_3jpp8	2.11.4-alt1_4jpp11	ALT-PU-2018-1722-1	206492	Fixed
jackson-databind	p10	2.9.4-alt1_3jpp8	2.11.4-alt1_2jpp11	ALT-PU-2018-1722-1	206492	Fixed
jackson-databind	p9	2.9.4-alt1_3jpp8	2.9.4-alt1_4jpp8	ALT-PU-2018-1722-1	206492	Fixed
jackson-databind	c10f1	2.9.4-alt1_3jpp8	2.11.4-alt1_2jpp11	ALT-PU-2018-1722-1	206492	Fixed
jackson-databind	c9f2	2.9.4-alt1_3jpp8	2.9.4-alt1_4jpp8	ALT-PU-2018-1722-1	206492	Fixed
jackson-databind	p11	2.9.4-alt1_3jpp8	2.11.4-alt1_4jpp11	ALT-PU-2018-1722-1	206492	Fixed

References to Advisories, Solutions, and Tools

Hyperlink	Resource
https://github.com/FasterXML/jackson-databind/issues/1599	Issue Tracking Patch Third Party Advisory
https://github.com/FasterXML/jackson-databind/issues/1723	Issue Tracking Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1462702	Issue Tracking Third Party Advisory
DSA-4004	Third Party Advisory
https://security.netapp.com/advisory/ntap-20171214-0002/	Third Party Advisory
RHSA-2017:3458	Third Party Advisory
RHSA-2017:3456	Third Party Advisory
RHSA-2017:3455	Third Party Advisory
RHSA-2017:3454	Third Party Advisory
RHSA-2017:3141	Third Party Advisory
RHSA-2017:2638	Third Party Advisory
RHSA-2017:2637	Third Party Advisory
RHSA-2017:2636	Third Party Advisory
RHSA-2017:2635	Third Party Advisory
RHSA-2017:2633	Third Party Advisory
RHSA-2017:2547	Third Party Advisory
RHSA-2017:2546	Third Party Advisory
RHSA-2017:2477	Third Party Advisory
RHSA-2017:1840	Third Party Advisory
RHSA-2017:1839	Third Party Advisory
RHSA-2017:1837	Third Party Advisory
RHSA-2017:1836	Third Party Advisory
RHSA-2017:1835	Third Party Advisory
RHSA-2017:1834	Third Party Advisory
1039947	Third Party Advisory VDB Entry
1039744	Third Party Advisory VDB Entry
99623	Third Party Advisory VDB Entry
https://cwiki.apache.org/confluence/display/WW/S2-055	Third Party Advisory
RHSA-2018:0294	Third Party Advisory
1040360	Third Party Advisory VDB Entry
RHSA-2018:0342	Third Party Advisory
http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html	Patch Third Party Advisory
RHSA-2018:1450	Third Party Advisory
RHSA-2018:1449	Third Party Advisory
http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html	Patch Third Party Advisory
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03902en_us	Third Party Advisory
http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html	Patch Third Party Advisory
https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html	Patch Third Party Advisory
https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html	Patch Third Party Advisory
RHSA-2019:0910	Third Party Advisory
https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html	Patch Third Party Advisory
RHSA-2019:2858	Third Party Advisory
RHSA-2019:3149	Third Party Advisory
[debian-lts-announce] 20200131 [SECURITY] [DLA 2091-1] libjackson-json-java security update	Mailing List Third Party Advisory
[debian-lts-announce] 20200824 [SECURITY] [DLA 2342-1] libjackson-json-java security update	Mailing List Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2020.html	Third Party Advisory
[lucene-solr-user] 20190104 Re: SOLR v7 Security Issues Caused Denial of Use - Sonatype Application Composition Report
[lucene-dev] 20190325 [jira] [Closed] (SOLR-13110) CVE-2017-7525 Threat Level 9 Against Solr v7.6. org.codehaus.jackson : jackson-mapper-asl : 1.9.13. .A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, ...
[lucene-dev] 20190325 [jira] [Updated] (SOLR-13110) CVE-2017-7525 Threat Level 9 Against Solr v7.6. org.codehaus.jackson : jackson-mapper-asl : 1.9.13. .A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, ...
[lucene-dev] 20190325 [jira] [Assigned] (SOLR-13110) CVE-2017-7525 Threat Level 9 Against Solr v7.6. org.codehaus.jackson : jackson-mapper-asl : 1.9.13. .A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, ...
[lucene-dev] 20190325 [jira] [Resolved] (SOLR-13110) CVE-2017-7525 Threat Level 9 Against Solr v7.6. org.codehaus.jackson : jackson-mapper-asl : 1.9.13. .A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, ...
[lucene-dev] 20190325 [jira] [Updated] (SOLR-13110) CVE-2017-7525 Threat Level 9 Against Solr v7.6. org.codehaus.jackson : jackson-mapper-asl : 1.9.13. .A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, ...
[cassandra-commits] 20191113 [jira] [Created] (CASSANDRA-15416) CVE-2017-7525 ( jackson-databind is vulnerable to Remote Code Execution) on version 3.11.4
[druid-commits] 20191115 [GitHub] [incubator-druid] ccaominh opened a new pull request #8878: Address security vulnerabilities
[lucene-solr-user] 20191218 CVE-2017-7525 fix for Solr 7.7.x
[lucene-solr-user] 20191218 Re: CVE-2017-7525 fix for Solr 7.7.x
[lucene-solr-user] 20191219 Re: CVE-2017-7525 fix for Solr 7.7.x
[spark-issues] 20210223 [jira] [Created] (SPARK-34511) Current Security vulnerabilities in spark libraries
[cassandra-commits] 20210927 [jira] [Commented] (CASSANDRA-15416) CVE-2017-7525 ( jackson-databind is vulnerable to Remote Code Execution) on version 3.11.4
[cassandra-commits] 20210927 [jira] [Updated] (CASSANDRA-15416) CVE-2017-7525 ( jackson-databind is vulnerable to Remote Code Execution) on version 3.11.4

Affected configurations:
1. Configuration 1
  cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*
  End excliding
  2.6.7.1
  cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*
  Start including
  2.8.0
  End excliding
  2.8.9
  cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*
  Start including
  2.7.0
  End excliding
  2.7.9.1
  cpe:2.3:a:fasterxml:jackson-databind:2.9.0:prerelease1:*:*:*:*:*:*
  cpe:2.3:a:fasterxml:jackson-databind:2.9.0:prerelease2:*:*:*:*:*:*
  
  Configuration 2
  cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
  cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
  
  Configuration 3
  cpe:2.3:a:netapp:oncommand_balance:-:*:*:*:*:*:*:*
  cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:*
  cpe:2.3:a:netapp:oncommand_shift:-:*:*:*:*:*:*:*
  cpe:2.3:a:netapp:oncommand_performance_manager:-:*:*:*:*:vmware_vsphere:*:*
  cpe:2.3:a:netapp:oncommand_performance_manager:-:*:*:*:*:linux:*:*
  
  Configuration 4
  cpe:2.3:a:redhat:openshift_container_platform:4.1:*:*:*:*:*:*:*
  cpe:2.3:a:redhat:virtualization:4.0:*:*:*:*:*:*:*
  cpe:2.3:a:redhat:virtualization_host:4.0:*:*:*:*:*:*:*
  Running on/with:
  cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
  
  Configuration 5
  cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.0.0:*:*:*:*:*:*:*
  cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.4.0:*:*:*:*:*:*:*
  cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0:*:*:*:*:*:*:*
  cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.1:*:*:*:*:*:*:*
  Running on/with:
  cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
  Running on/with:
  cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
  
  Configuration 6
  cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.0.0:*:*:*:*:*:*:*
  cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.4.0:*:*:*:*:*:*:*
  Running on/with:
  cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:*
  
  Configuration 7
  cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:*
  
  Configuration 8
  cpe:2.3:a:oracle:primavera_unifier:16.2:*:*:*:*:*:*:*
  cpe:2.3:a:oracle:banking_platform:2.5.0:*:*:*:*:*:*:*
  cpe:2.3:a:oracle:primavera_unifier:16.1:*:*:*:*:*:*:*
  cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:*
  cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.5.0.0:*:*:*:*:*:*:*
  cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.4.0.0:*:*:*:*:*:*:*
  cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.3.0.0:*:*:*:*:*:*:*
  cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.2.0.0:*:*:*:*:*:*:*
  cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:*
  Start including
  17.1
  End including
  17.12
  cpe:2.3:a:oracle:communications_billing_and_revenue_management:7.5:*:*:*:*:*:*:*
  cpe:2.3:a:oracle:communications_billing_and_revenue_management:12.0:*:*:*:*:*:*:*
  cpe:2.3:a:oracle:banking_platform:2.6.0:*:*:*:*:*:*:*
  cpe:2.3:a:oracle:banking_platform:2.6.1:*:*:*:*:*:*:*
  cpe:2.3:a:oracle:banking_platform:2.6.2:*:*:*:*:*:*:*
  cpe:2.3:a:oracle:enterprise_manager_for_virtualization:13.2.2:*:*:*:*:*:*:*
  cpe:2.3:a:oracle:enterprise_manager_for_virtualization:13.2.3:*:*:*:*:*:*:*
  cpe:2.3:a:oracle:enterprise_manager_for_virtualization:13.3.1:*:*:*:*:*:*:*
  cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:*
  cpe:2.3:a:oracle:communications_instant_messaging_server:10.0.1:*:*:*:*:*:*:*
  cpe:2.3:a:oracle:communications_communications_policy_management:*:*:*:*:*:*:*:*
  Start including
  12.0
  End including
  12.5.2
  cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.7.0.0:*:*:*:*:*:*:*
  cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.6.0.0:*:*:*:*:*:*:*
  cpe:2.3:a:oracle:communications_diameter_signaling_route:*:*:*:*:*:*:*:*
  End excliding
  8.3
  cpe:2.3:a:oracle:utilities_advanced_spatial_and_operational_analytics:2.7.0.1:*:*:*:*:*:*:*
  cpe:2.3:a:oracle:communications_instant_messaging_server:10.0.1.2.0:*:*:*:*:*:*:*
  cpe:2.3:a:oracle:global_lifecycle_management_opatchauto:*:*:*:*:*:*:*:*
  End excliding
  12.2.0.1.14

Version: v24.5.3

Vulnerability CVE-2017-7525: Information

Description

Fixed packages

References to Advisories, Solutions, and Tools

Configuration 1

Configuration 2

Configuration 3

Configuration 4

Configuration 5

Configuration 6

Configuration 7

Configuration 8