CVE-2017-15095

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2017-15095
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-15095.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2017-15095
Aliases
Downstream
Related
Published
2018-02-06T15:29:00.233Z
Modified
2026-03-15T22:24:02.748466Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaw CVE-2017-7525 by blacklisting more classes that could be used maliciously.

References

Affected packages

Git / github.com/FasterXML/jackson-databind

Affected ranges

Type
GIT
Repo
https://github.com/FasterXML/jackson-databind
Events
Introduced
e8df0987e3034d102ee6d704d30a05a2e3ac7089
Fixed
fab5c3877f7b8ae28a8e3a14d805bc9dcc8c153d
Introduced
50791cc7856376949287e0be3e96147665ab8f68
Fixed
9e170e1a28221cf273e8a63e01f1731a9fcd11bc
Introduced
81929fad84189ce59ef82e7a6d0df795eb0c7cdb
Fixed
0b6e589c1c0ee20854ac0efeafacbf2782fc9f1c
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
e969f0a31b781f5dfb74e16ddd5ee4b4fa36e8d8
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
d90fe4c654d1c1d54e24b15deae3ad0443b0f8f6
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
418ee6e0a91401365982794cc9b18a55b26655e5
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
7541ac546f49d61182d0262df7ca617ef3063bf1
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
822ca4a7db3c3653cea1d0b493e4dfc53d56e15a
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
9efc4abb22c664c492271bc9907bbfbf4f70889c
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
21f90cf247018c1286cc20544029782450dc270a
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
060726b011b008496cd8bb0997ee94a6b73530d1
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
3739d9dfbf24b6822b90274ba346ad209eb289fd
Database specific 
{
    "versions": [
        {
            "introduced": "2.0.0"
        },
        {
            "fixed": "2.6.7.2"
        },
        {
            "introduced": "2.7.0"
        },
        {
            "fixed": "2.7.9.2"
        },
        {
            "introduced": "2.8.0"
        },
        {
            "fixed": "2.8.10"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.9.0-NA"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.9.0-prerelease1"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.9.0-prerelease2"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.9.0-prerelease3"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.9.0-prerelease4"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.5.0"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.6.0"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.6.1"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.6.2"
        }
    ]
}

Affected versions

2.*
2.2.0c
2.6.0-rc3b
jackson-databind-2.*
jackson-databind-2.0.0
jackson-databind-2.0.1
jackson-databind-2.0.2
jackson-databind-2.0.4
jackson-databind-2.1.0
jackson-databind-2.1.1
jackson-databind-2.2.0
jackson-databind-2.2.0-rc1
jackson-databind-2.2.1
jackson-databind-2.2.2
jackson-databind-2.3.0
jackson-databind-2.3.0-rc1
jackson-databind-2.3.1
jackson-databind-2.4.0
jackson-databind-2.4.0-rc1
jackson-databind-2.4.0-rc2
jackson-databind-2.4.0-rc3
jackson-databind-2.4.1
jackson-databind-2.4.1.1
jackson-databind-2.4.1.2
jackson-databind-2.4.1.3
jackson-databind-2.4.2
jackson-databind-2.4.3
jackson-databind-2.4.4
jackson-databind-2.4.5
jackson-databind-2.4.5.1
jackson-databind-2.4.6
jackson-databind-2.5.0
jackson-databind-2.5.0-rc1
jackson-databind-2.5.1
jackson-databind-2.5.2
jackson-databind-2.5.3
jackson-databind-2.5.4
jackson-databind-2.5.5
jackson-databind-2.6.0
jackson-databind-2.6.0-rc1
jackson-databind-2.6.0-rc2
jackson-databind-2.6.0-rc4
jackson-databind-2.6.1
jackson-databind-2.6.2
jackson-databind-2.6.3
jackson-databind-2.6.4
jackson-databind-2.6.5
jackson-databind-2.6.6
jackson-databind-2.6.7
jackson-databind-2.6.7.1
jackson-databind-2.7.0
jackson-databind-2.7.0-rc1
jackson-databind-2.7.0-rc2
jackson-databind-2.7.0-rc3
jackson-databind-2.7.1
jackson-databind-2.7.1-1
jackson-databind-2.7.2
jackson-databind-2.7.3
jackson-databind-2.7.4
jackson-databind-2.7.5
jackson-databind-2.7.6
jackson-databind-2.7.7
jackson-databind-2.7.8
jackson-databind-2.7.9
jackson-databind-2.7.9.1

Database specific

unresolved_ranges 
[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "8.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "9.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "3.11"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "6.4"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "6.4"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "4.1"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "6.0.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "6.4.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "7.1.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "12.1.0.2.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "7.5"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "12.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "fixed": "8.3"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "10.0.1.2.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "12.2.0.1"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "18.1"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "13.2.2"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "13.2.3"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "13.3.1"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "8.0.2"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "8.0.3"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "8.0.4"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "8.0.5"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "8.0.6"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "8.0.7"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "fixed": "12.2.0.1.14"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "11.1.2.3.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "12.2.1.3.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "9.2"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "17.1"
            },
            {
                "last_affected": "17.12"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "16.1"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "16.2"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "18.8"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "2.7.0.1"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "12.2.1.3.0"
            }
        ]
    }
]
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-15095.json"