CVE-2017-17485
CRITICAL
9.8
CVSS Severity Score
Vulnerability Description
FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the Spring libraries are available in the classpath.
Affected Platforms (CPE)
📦
Fasterxml
Jackson Databind
< 2.6.7.3📦
Fasterxml
Jackson Databind
>= 2.7.0 and < 2.7.9.2📦
Fasterxml
Jackson Databind
>= 2.8.0 and < 2.8.11📦
Fasterxml
Jackson Databind
>= 2.9.0 and < 2.9.4💻
Debian
Debian Linux
= 8.0💻
Debian
Debian Linux
= 9.0📦
Redhat
Jboss Enterprise Application Platform
= 6.0.0📦
Redhat
Jboss Enterprise Application Platform
= 6.4.0📦
Redhat
Jboss Enterprise Application Platform
= 7.1📦
Redhat
Openshift Container Platform
= 4.1📦
Redhat
Openshift Container Platform
= 3.11📦
Netapp
E Series Santricity Os Controller
>= 11.0.0 and <= 11.60.3📦
Netapp
E Series Santricity Web Services Proxy
All versions📦
Netapp
Oncommand Shift
All versions📦
Netapp