CVE-2017-15095

Description from NVD

A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaw CVE-2017-7525 by blacklisting more classes that could be used maliciously.

Information Acquisition Date:2023-03-01T15:02Z

CVSS 2.0: 7.5 HIGH CVSS 3.x: 9.8 CRITICAL

▼ CVSS3 Vec CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector (AV)	Network	Adjacent	Local	Physical
Attack Complexity (AC)	LOW	High
Privileges Required (PR)	None	Low	High
User Interaction (UI)	None	Required
Scope (S)	Unchange	Change
Confidentiality (C)	None	Low	High
Integrity (I)	None	Low	High
Availability (A)	None	Low	High

▼ CVSS2 Vec AV:N/AC:L/Au:N/C:P/I:P/A:P

Attack Vector (AV)	Network	Adjacent	Local
Access Complexity (AC)	Low	Medium	High
Authentication (Au)	None	Single	Multiple
Confidentiality (C)	None	Parical	Complete
Integrity (I)	None	Partial	Complete
Availability (A)	None	Partial	Complete

NVD References

https://github.com/FasterXML/jackson-databind/issues/1737
source:CONFIRM
tags:Issue Tracking Patch Third Party Advisory

https://github.com/FasterXML/jackson-databind/issues/1680
source:CONFIRM
tags:Issue Tracking Third Party Advisory

DSA-4037
source:DEBIAN
tags:Third Party Advisory

https://security.netapp.com/advisory/ntap-20171214-0003/
source:CONFIRM
tags:Third Party Advisory

RHSA-2017:3190
source:REDHAT
tags:Third Party Advisory

RHSA-2017:3189
source:REDHAT
tags:Third Party Advisory

1039769
source:SECTRACK
tags:Third Party Advisory VDB Entry

RHSA-2018:0342
source:REDHAT
tags:Third Party Advisory

RHSA-2018:0481
source:REDHAT
tags:Third Party Advisory

RHSA-2018:0480
source:REDHAT
tags:Third Party Advisory

RHSA-2018:0479
source:REDHAT
tags:Third Party Advisory

RHSA-2018:0478
source:REDHAT
tags:Third Party Advisory

RHSA-2018:0577
source:REDHAT
tags:Third Party Advisory

RHSA-2018:0576
source:REDHAT
tags:Third Party Advisory

103880
source:BID
tags:Third Party Advisory VDB Entry

http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
source:CONFIRM
tags:Patch Third Party Advisory

RHSA-2018:1451
source:REDHAT
tags:Third Party Advisory

RHSA-2018:1450
source:REDHAT
tags:Third Party Advisory

RHSA-2018:1449
source:REDHAT
tags:Third Party Advisory

RHSA-2018:1448
source:REDHAT
tags:Third Party Advisory

RHSA-2018:1447
source:REDHAT
tags:Third Party Advisory

http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
source:CONFIRM
tags:Patch Third Party Advisory

http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
source:CONFIRM
tags:Patch Third Party Advisory

RHSA-2018:2927
source:REDHAT
tags:Third Party Advisory

https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
source:CONFIRM
tags:Patch Third Party Advisory

https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
source:MISC
tags:Patch Third Party Advisory

RHSA-2019:2858
source:REDHAT
tags:Third Party Advisory

RHSA-2019:3149
source:REDHAT
tags:Third Party Advisory

RHSA-2019:3892
source:REDHAT
tags:Third Party Advisory

[lucene-solr-user] 20191219 Re: CVE-2017-7525 fix for Solr 7.7.x
source:MLIST
tags:Mailing List Third Party Advisory

[debian-lts-announce] 20200131 [SECURITY] [DLA 2091-1] libjackson-json-java security update
source:MLIST
tags:Mailing List Third Party Advisory

https://www.oracle.com/security-alerts/cpuoct2020.html
source:MISC
tags:Third Party Advisory

Description from Forti

CVE-2017-17485jackson-databind: Unsafe deserialization due to incomplete black list (incomplete fix forCVE-2017-15095) [fedora-all]

Information Acquisition Date:2023/03/01

Affected Products

Impact

Recommended Actions

References

Refer to Information on External Sites

CVE Infomation	Exploits or more Infomation
mitre	EXPLOIT DATABASE
NVD	0day.today
vulmon.com	github
CVE Details	Twitter
JVN ENG JPN
Reconshell

Software Tag: BIND(4 tweets) Oracle(28 tweets)

List of frequently cited URLs

URL	Num of Times Referred to
http://vulmon.com/vulnerabilitydetails?qid=CVE	1591
https://alerts.vulmon.com/?utm_source=twitter&utm_medium=so...	272

▼ Show Information from Twitter(58)

User	URL	Info Source	Date
WolfgangSesin	http://www.sesin.at	Source WolfgangSesin 1630564879605067776	2023/02/28
WolfgangSesin	https://www.sesin.at/2023/02/28/cve-2017-15095-oracle-commu...	Source WolfgangSesin 1630564879605067776	2023/02/28
www_sesin_at	http://www.sesin.at	Source www_sesin_at 1630564881945489408	2023/02/28
www_sesin_at	https://www.sesin.at/2023/02/28/cve-2017-15095-oracle-commu...	Source www_sesin_at 1630564881945489408	2023/02/28
WolfgangSesin	http://www.sesin.at	Source WolfgangSesin 1630564897988722691	2023/02/28
WolfgangSesin	https://www.sesin.at/2023/02/28/cve-2017-15095-oracle-commu...	Source WolfgangSesin 1630564897988722691	2023/02/28
www_sesin_at	http://www.sesin.at	Source www_sesin_at 1630564900446560260	2023/02/28
www_sesin_at	https://www.sesin.at/2023/02/28/cve-2017-15095-oracle-commu...	Source www_sesin_at 1630564900446560260	2023/02/28
WolfgangSesin	http://www.sesin.at	Source WolfgangSesin 1630576183803801602	2023/02/28
WolfgangSesin	https://www.sesin.at/2023/02/28/cve-2017-15095-oracle-prima...	Source WolfgangSesin 1630576183803801602	2023/02/28
www_sesin_at	http://www.sesin.at	Source www_sesin_at 1630576185976537088	2023/02/28
www_sesin_at	https://www.sesin.at/2023/02/28/cve-2017-15095-oracle-prima...	Source www_sesin_at 1630576185976537088	2023/02/28
WolfgangSesin	http://www.sesin.at	Source WolfgangSesin 1630588223570206722	2023/03/01
WolfgangSesin	https://www.sesin.at/2023/02/28/cve-2017-15095-oracle-enter...	Source WolfgangSesin 1630588223570206722	2023/03/01
www_sesin_at	http://www.sesin.at	Source www_sesin_at 1630588226170679298	2023/03/01
www_sesin_at	https://www.sesin.at/2023/02/28/cve-2017-15095-oracle-enter...	Source www_sesin_at 1630588226170679298	2023/03/01
WolfgangSesin	http://www.sesin.at	Source WolfgangSesin 1630610114108375040	2023/03/01
WolfgangSesin	https://www.sesin.at/2023/02/28/cve-2017-15095-oracle-banki...	Source WolfgangSesin 1630610114108375040	2023/03/01
www_sesin_at	http://www.sesin.at	Source www_sesin_at 1630610116415193089	2023/03/01
www_sesin_at	https://www.sesin.at/2023/02/28/cve-2017-15095-oracle-banki...	Source www_sesin_at 1630610116415193089	2023/03/01
WolfgangSesin	http://www.sesin.at	Source WolfgangSesin 1630610128247439371	2023/03/01
WolfgangSesin	https://www.sesin.at/2023/02/28/cve-2017-15095-oracle-banki...	Source WolfgangSesin 1630610128247439371	2023/03/01
www_sesin_at	http://www.sesin.at	Source www_sesin_at 1630610130483003412	2023/03/01
www_sesin_at	https://www.sesin.at/2023/02/28/cve-2017-15095-oracle-banki...	Source www_sesin_at 1630610130483003412	2023/03/01
WolfgangSesin	http://www.sesin.at	Source WolfgangSesin 1630610142390542336	2023/03/01
WolfgangSesin	https://www.sesin.at/2023/02/28/cve-2017-15095-oracle-banki...	Source WolfgangSesin 1630610142390542336	2023/03/01
www_sesin_at	http://www.sesin.at	Source www_sesin_at 1630610145037131776	2023/03/01
www_sesin_at	https://www.sesin.at/2023/02/28/cve-2017-15095-oracle-banki...	Source www_sesin_at 1630610145037131776	2023/03/01
WolfgangSesin	http://www.sesin.at	Source WolfgangSesin 1630610157188030465	2023/03/01
WolfgangSesin	https://www.sesin.at/2023/02/28/cve-2017-15095-oracle-banki...	Source WolfgangSesin 1630610157188030465	2023/03/01
www_sesin_at	http://www.sesin.at	Source www_sesin_at 1630610159457255440	2023/03/01
www_sesin_at	https://www.sesin.at/2023/02/28/cve-2017-15095-oracle-banki...	Source www_sesin_at 1630610159457255440	2023/03/01
Har_sia	https://har-sia.info/CVE-2017-15095.html	Source Har_sia 1630635351638417408	2023/03/01
Har_sia	https://har-sia.info/CVE-2017-15095.html	Source Har_sia 1630998223744802816	2023/03/02
WolfgangSesin	http://www.sesin.at	Source WolfgangSesin 1631272261381496838	2023/03/02
WolfgangSesin	https://www.sesin.at/2023/03/02/cve-2017-15095-oracle-jd-ed...	Source WolfgangSesin 1631272261381496838	2023/03/02
www_sesin_at	http://www.sesin.at	Source www_sesin_at 1631272264376123396	2023/03/02
www_sesin_at	https://www.sesin.at/2023/03/02/cve-2017-15095-oracle-jd-ed...	Source www_sesin_at 1631272264376123396	2023/03/02
WolfgangSesin	http://www.sesin.at	Source WolfgangSesin 1631277181996236800	2023/03/02
WolfgangSesin	https://www.sesin.at/2023/03/02/cve-2017-15095-oracle-webce...	Source WolfgangSesin 1631277181996236800	2023/03/02
www_sesin_at	http://www.sesin.at	Source www_sesin_at 1631277184798056448	2023/03/02
www_sesin_at	https://www.sesin.at/2023/03/02/cve-2017-15095-oracle-webce...	Source www_sesin_at 1631277184798056448	2023/03/02
WolfgangSesin	http://www.sesin.at	Source WolfgangSesin 1631569786281893889	2023/03/03
WolfgangSesin	https://www.sesin.at/2023/03/03/cve-2017-15095-oracle-retai...	Source WolfgangSesin 1631569786281893889	2023/03/03
www_sesin_at	http://www.sesin.at	Source www_sesin_at 1631569790262206464	2023/03/03
www_sesin_at	https://www.sesin.at/2023/03/03/cve-2017-15095-oracle-retai...	Source www_sesin_at 1631569790262206464	2023/03/03
WolfgangSesin	http://www.sesin.at	Source WolfgangSesin 1631575554871754752	2023/03/03
WolfgangSesin	https://www.sesin.at/2023/03/03/cve-2017-15095-oracle-retai...	Source WolfgangSesin 1631575554871754752	2023/03/03
www_sesin_at	http://www.sesin.at	Source www_sesin_at 1631575557807779844	2023/03/03
www_sesin_at	https://www.sesin.at/2023/03/03/cve-2017-15095-oracle-retai...	Source www_sesin_at 1631575557807779844	2023/03/03
WolfgangSesin	http://www.sesin.at	Source WolfgangSesin 1631593450335240193	2023/03/03
WolfgangSesin	https://www.sesin.at/2023/03/03/cve-2017-15095-oracle-agile...	Source WolfgangSesin 1631593450335240193	2023/03/03
www_sesin_at	http://www.sesin.at	Source www_sesin_at 1631593452549861377	2023/03/03
www_sesin_at	https://www.sesin.at/2023/03/03/cve-2017-15095-oracle-agile...	Source www_sesin_at 1631593452549861377	2023/03/03
WolfgangSesin	http://www.sesin.at	Source WolfgangSesin 1645071694493540353	2023/04/09
WolfgangSesin	https://www.sesin.at/2023/04/09/cve-2017-15095-oracle-datab...	Source WolfgangSesin 1645071694493540353	2023/04/09
www_sesin_at	http://www.sesin.at	Source www_sesin_at 1645071697089888256	2023/04/09
www_sesin_at	https://www.sesin.at/2023/04/09/cve-2017-15095-oracle-datab...	Source www_sesin_at 1645071697089888256	2023/04/09

List of frequently cited URLs

URL	Num of Times Referred to
vulmon.com	1591
alerts.vulmon.com	272

▼ Show Information from Twitter(58)

User	URL	Info Source
WolfgangSesin	sesin.at	Show Tweet
WolfgangSesin	sesin.at	Show Tweet
www_sesin_at	sesin.at	Show Tweet
www_sesin_at	sesin.at	Show Tweet
WolfgangSesin	sesin.at	Show Tweet
WolfgangSesin	sesin.at	Show Tweet
www_sesin_at	sesin.at	Show Tweet
www_sesin_at	sesin.at	Show Tweet
WolfgangSesin	sesin.at	Show Tweet
WolfgangSesin	sesin.at	Show Tweet
www_sesin_at	sesin.at	Show Tweet
www_sesin_at	sesin.at	Show Tweet
WolfgangSesin	sesin.at	Show Tweet
WolfgangSesin	sesin.at	Show Tweet
www_sesin_at	sesin.at	Show Tweet
www_sesin_at	sesin.at	Show Tweet
WolfgangSesin	sesin.at	Show Tweet
WolfgangSesin	sesin.at	Show Tweet
www_sesin_at	sesin.at	Show Tweet
www_sesin_at	sesin.at	Show Tweet
WolfgangSesin	sesin.at	Show Tweet
WolfgangSesin	sesin.at	Show Tweet
www_sesin_at	sesin.at	Show Tweet
www_sesin_at	sesin.at	Show Tweet
WolfgangSesin	sesin.at	Show Tweet
WolfgangSesin	sesin.at	Show Tweet
www_sesin_at	sesin.at	Show Tweet
www_sesin_at	sesin.at	Show Tweet
WolfgangSesin	sesin.at	Show Tweet
WolfgangSesin	sesin.at	Show Tweet
www_sesin_at	sesin.at	Show Tweet
www_sesin_at	sesin.at	Show Tweet
Har_sia	har-sia.info	Show Tweet
Har_sia	har-sia.info	Show Tweet
WolfgangSesin	sesin.at	Show Tweet
WolfgangSesin	sesin.at	Show Tweet
www_sesin_at	sesin.at	Show Tweet
www_sesin_at	sesin.at	Show Tweet
WolfgangSesin	sesin.at	Show Tweet
WolfgangSesin	sesin.at	Show Tweet
www_sesin_at	sesin.at	Show Tweet
www_sesin_at	sesin.at	Show Tweet
WolfgangSesin	sesin.at	Show Tweet
WolfgangSesin	sesin.at	Show Tweet
www_sesin_at	sesin.at	Show Tweet
www_sesin_at	sesin.at	Show Tweet
WolfgangSesin	sesin.at	Show Tweet
WolfgangSesin	sesin.at	Show Tweet
www_sesin_at	sesin.at	Show Tweet
www_sesin_at	sesin.at	Show Tweet
WolfgangSesin	sesin.at	Show Tweet
WolfgangSesin	sesin.at	Show Tweet
www_sesin_at	sesin.at	Show Tweet
www_sesin_at	sesin.at	Show Tweet
WolfgangSesin	sesin.at	Show Tweet
WolfgangSesin	sesin.at	Show Tweet
www_sesin_at	sesin.at	Show Tweet
www_sesin_at	sesin.at	Show Tweet

GitHub Search Results: Up to 10

Name	URL
SecureSkyTechnology/study-struts2-s2-054_055-jackson-cve-2017-7525_cve-2017-15095	https://github.com/SecureSkyTechnology/study-struts2-s2-054_055-jackson-cve-2017-7525_cve-2017-15095

GitHub Search Results: Up to 10

Name	URL
SecureSkyTechnology/study-struts2-s2-054_055-jackson-cve-2017-7525_cve-2017-15095	github.com

2023/04/09 Score : 0
Added Har-sia Database : 2020/10/10
Last Modified : 2023/04/09
Highest Scored Date : 2023/02/28
Highest Score : 17