vulnwire
9.8crit

CVE-2017-17485in critical feed

jackson-databind vulnerable to remote code execution due to incorrect deserialization and blocklist bypass

Also known as GHSA-rfx6-vp9g-rh7v

Published 8 y ago · modified 4 mo ago · JSON

CVSS
9.8
v3.1 · CNA
CISA KEV
No
not known exploited
EPSS
49.7%
percentile 99%
Public exploits
0
none known

FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the Spring libraries are available in the classpath.

CISA SSVC assessment

Exploitation
none
Automatable
yes
Technical impact
total
Assessed
14 mo ago

Exploit prediction (EPSS)

49.73% probability of exploitation in the next 30 days, higher than 99% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
CISA ADP3.19.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD3.19.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA3.19.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD2.07.5AV:N/AC:L/Au:N/C:P/I:P/A:P
GitHub3.19.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

EcosystemPackageAffectedFixed in
mavencom.fasterxml.jackson.core:jackson-databind
>=2.9.0, <2.9.4
>=2.8.0, <2.8.11
<2.7.9.2
2.9.4
2.8.11
2.7.9.2

Classification

Weakness
  • CWE-502 Deserialization of Untrusted Data

References

  • access.redhat.com /errata/RHSA-2018:1448 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • access.redhat.com /errata/RHSA-2018:0479 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • access.redhat.com /errata/RHSA-2018:0481 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • access.redhat.com /errata/RHSA-2018:1449 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • access.redhat.com /errata/RHSA-2018:1450 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • access.redhat.com /errata/RHSA-2018:1451 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • access.redhat.com /errata/RHSA-2018:0116 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • access.redhat.com /errata/RHSA-2018:0342 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • securityfocus.com /archive/1/541652/100/0/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • access.redhat.com /errata/RHSA-2018:0480 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • access.redhat.com /errata/RHSA-2018:1447 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • debian.org /security/2018/dsa-4114 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • access.redhat.com /errata/RHSA-2018:0478 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • access.redhat.com /errata/RHSA-2018:2930 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • access.redhat.com /errata/RHSA-2019:1782 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • access.redhat.com /errata/RHSA-2019:1797 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • access.redhat.com /errata/RHSA-2019:2858 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • access.redhat.com /errata/RHSA-2019:3149 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • access.redhat.com /errata/RHSA-2019:3892 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • oracle.com /security-alerts/cpuoct2020.html · x_refsource_MISC, x_transferred
  • security.netapp.com /advisory/ntap-20180201-0003/ · x_refsource_CONFIRM, x_transferred
  • support.hpe.com /hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03902en_us · x_refsource_CONFIRM, x_transferred
  • github.com /FasterXML/jackson-databind/issues/1855 · x_refsource_CONFIRM, x_transferred
  • github.com /irsl/jackson-rce-via-spel/ · x_refsource_MISC, x_transferred
  • nvd.nist.gov /vuln/detail/CVE-2017-17485 · advisory
  • github.com /FasterXML/jackson-databind/commit/10fe7f17ea7c8da2a71e7a0c774b420a1d5c1b50 · web
  • github.com /FasterXML/jackson-databind/commit/2235894210c75f624a3d0cd60bfb0434a20a18bf · web
  • github.com /FasterXML/jackson-databind/commit/459107dccc9b3ea991af3e6ad0953e54b01ef7c1 · web
  • github.com /FasterXML/jackson-databind/commit/4f16f67ebd22c7522fdbb8a7eb87e3026a807d61 · web
  • github.com /FasterXML/jackson-databind/commit/978798382ceb72229e5036aa1442943933d6d171 · web
  • github.com /FasterXML/jackson-databind/commit/f031f27a31625d07922bdd090664c69544200a5d · web
  • github.com /FasterXML/jackson-databind/commit/eb217dd0f87c5fb471e0668575644aa7eba9a3d3 · web
  • github.com /FasterXML/jackson-databind/commit/bb45fb16709018842f858f1a6e1118676aaa34bd · web
  • github.com /FasterXML/jackson-databind · package
  • github.com /irsl/jackson-rce-via-spel · web
  • security.netapp.com /advisory/ntap-20180201-0003 · web
  • web.archive.org /web/20200927162225/http://www.securityfocus.com/archive/1/541652/100/0/threaded · web

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.