{"id":"CVE-2017-15095","published":"2018-02-06T15:00:00Z","modified":"2026-10-08T21:13:48Z","title":"A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow…","vendor":"FasterXML","product":"jackson-databind","tier":"tail","description":{"text":"A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaw CVE-2017-7525 by blacklisting more classes that could be used maliciously.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.08357,"percentile":0.94947,"provenance":"source"},"cwes":[{"id":"CWE-184","name":"Incomplete List of Disallowed Inputs"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2018:1448","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://www.securityfocus.com/bid/103880","tags":["vdb-entry","x_refsource_BID"]},{"url":"https://access.redhat.com/errata/RHSA-2018:0479","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2018:0481","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2018:1449","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2018:1450","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2018:0577","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2018:0576","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2017:3190","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2018:1451","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2017:3189","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2018:2927","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://www.securitytracker.com/id/1039769","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"https://access.redhat.com/errata/RHSA-2018:0342","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2018:0480","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2018:1447","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2018:0478","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://www.debian.org/security/2017/dsa-4037","tags":["vendor-advisory","x_refsource_DEBIAN"]},{"url":"https://access.redhat.com/errata/RHSA-2019:2858","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2019:3149","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2019:3892","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://lists.apache.org/thread.html/f095a791bda6c0595f691eddd0febb2d396987eec5cbd29120d8c629%40%3Csolr-user.lucene.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/01/msg00037.html","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","tags":["x_refsource_CONFIRM"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","tags":["x_refsource_CONFIRM"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","tags":["x_refsource_CONFIRM"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","tags":["x_refsource_CONFIRM"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","tags":["x_refsource_MISC"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2020.html","tags":["x_refsource_MISC"]},{"url":"https://security.netapp.com/advisory/ntap-20171214-0003/","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/FasterXML/jackson-databind/issues/1737","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/FasterXML/jackson-databind/issues/1680","tags":["x_refsource_CONFIRM"]}],"priority":{"score":19.0,"factors":[{"name":"EPSS percentile","points":18.99}]},"vendorSlug":"fasterxml","affectedVersions":[{"vendor":"FasterXML","product":"jackson-databind","versions":["before 2.8.10","before 2.9.1"]}],"affected":[{"ecosystem":"Maven","package":"com.fasterxml.jackson.core:jackson-databind","vulnerableRanges":[">=2.8.0, <2.8.11",">=2.9.0, <2.9.4",">=2.0.0, <2.6.7.3",">=2.7.0, <2.7.9.2"],"patched":["2.8.11","2.9.4","2.6.7.3","2.7.9.2"],"from":["GHSA-h592-38cm-4ggp"],"provenance":"source"}],"euvd":{"id":"EUVD-2018-0610","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-fasterxml-jackson-databind-cve-2017-4995","packageHistory":[{"cve":"CVE-2017-7525","published":"2018-02-06","fixed":"2.8.9","kev":false,"link":{"from":"CVE-2017-7525","to":"CVE-2017-15095","relation":"successor","confidence":"high","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:com.fasterxml.jackson.core:jackson-databind","fromFixed":"2.8.9","toFixed":"2.8.11","daysApart":0},{"kind":"same-code","provenance":"machine","files":["src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java"],"commits":["https://github.com/FasterXML/jackson-databind/commit/a054585e2175ad0882f07bcafedecfac86230f1b","https://github.com/FasterXML/jackson-databind/commit/a3939d36edcc755c8af55bdc1969e0fa8438f9db","https://github.com/FasterXML/jackson-databind/commit/fd8dec2c7fab8b4b4bd60502a0f1d63ec23c24da","https://github.com/FasterXML/jackson-databind/commit/fa87c1ddbe803ebb7295f5c2ebfe38e12f6e6162"],"basis":"shared file"},{"kind":"similar","provenance":"machine","score":0.78,"basis":"same product + CWE + description similarity"}]}},{"cve":"CVE-2017-15095","published":"2018-02-06","fixed":"2.9.4","kev":false},{"cve":"CVE-2017-17485","published":"2018-01-10","fixed":"2.9.4","kev":false},{"cve":"CVE-2018-5968","published":"2018-01-22","fixed":"2.9.4","kev":false},{"cve":"CVE-2018-7489","published":"2018-02-26","fixed":"2.9.5","kev":false,"link":{"from":"CVE-2017-15095","to":"CVE-2018-7489","relation":"successor","confidence":"high","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:com.fasterxml.jackson.core:jackson-databind","fromFixed":"2.8.11","toFixed":"2.8.11.1","daysApart":20},{"kind":"same-code","provenance":"machine","files":["src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java"],"commits":["https://github.com/FasterXML/jackson-databind/commit/a054585e2175ad0882f07bcafedecfac86230f1b","https://github.com/FasterXML/jackson-databind/commit/a3939d36edcc755c8af55bdc1969e0fa8438f9db","https://github.com/FasterXML/jackson-databind/commit/e66c0a9d3c926ff1b63bf586c824ead1d02f2a3d","https://github.com/FasterXML/jackson-databind/commit/ca2bfc86af82a1479112004b663ba74c760752e6"],"basis":"shared file"},{"kind":"similar","provenance":"machine","score":0.49,"basis":"same package + description similarity"}]}}],"package":"Maven:com.fasterxml.jackson.core:jackson-databind"}}