CVE-2017-7525

jackson-databind: Deserialization vulnerability via readValue method of ObjectMapper

View on CVE.org
Published Feb 6, 2018 CVSS 3.1 · 9.8 Critical EPSS 37.7% KEV · Not listed
Description
A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DLA Debian DLA DLA-2091-1 libjackson-json-java security update
Debian DLA Debian DLA DLA-2342-1 libjackson-json-java security update
Debian DSA Debian DSA DSA-4004-1 jackson-databind security update
Debian DSA Debian DSA DSA-4037-1 jackson-databind security update
Debian DSA Debian DSA DSA-4190-1 jackson-databind security update
Github GHSA Github GHSA GHSA-qxxx-2pp7-5hmx jackson-databind is vulnerable to a deserialization flaw
Ubuntu USN Ubuntu USN USN-4741-1 Jackson vulnerabilities
References
Link Providers
http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html cve-icon cve-icon
http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html cve-icon cve-icon
http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html cve-icon cve-icon
http://www.securityfocus.com/bid/99623 cve-icon cve-icon
http://www.securitytracker.com/id/1039744 cve-icon cve-icon
http://www.securitytracker.com/id/1039947 cve-icon cve-icon
http://www.securitytracker.com/id/1040360 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2017:1834 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2017:1835 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2017:1836 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2017:1837 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2017:1839 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2017:1840 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2017:2477 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2017:2546 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2017:2547 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2017:2633 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2017:2635 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2017:2636 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2017:2637 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2017:2638 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2017:3141 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2017:3454 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2017:3455 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2017:3456 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2017:3458 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2018:0294 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2018:0342 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2018:1449 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2018:1450 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2019:0910 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2019:2858 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2019:3149 cve-icon cve-icon
https://bugzilla.redhat.com/show_bug.cgi?id=1462702 cve-icon cve-icon
https://cwiki.apache.org/confluence/display/WW/S2-055 cve-icon cve-icon
https://github.com/FasterXML/jackson-databind/issues/1599 cve-icon cve-icon
https://github.com/FasterXML/jackson-databind/issues/1723 cve-icon cve-icon
https://lists.apache.org/thread.html/3c87dc8bca99a2b3b4743713b33d1de05b1d6b761fdf316224e9c81f%40%3Cdev.lucene.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/4641ed8616ccc2c1fbddac2c3dc9900c96387bc226eaf0232d61909b%40%3Ccommits.cassandra.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/5008bcbd45ee65ce39e4220b6ac53d28a24d6bc67d5804e9773a7399%40%3Csolr-user.lucene.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451%40%3Csolr-user.lucene.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe%40%3Ccommits.druid.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/b1f33fe5ade396bb903fdcabe9f243f7692c7dfce5418d3743c2d346%40%3Cdev.lucene.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/c10a2bf0fdc3d25faf17bd191d6ec46b29a353fa9c97bebd7c4e5913%40%3Cdev.lucene.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/c2ed4c0126b43e324cf740012a0edd371fd36096fd777be7bfe7a2a6%40%3Cdev.lucene.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/c9d5ff20929e8a3c8794facf4c4b326a9c10618812eec356caa20b87%40%3Csolr-user.lucene.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/f095a791bda6c0595f691eddd0febb2d396987eec5cbd29120d8c629%40%3Csolr-user.lucene.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/f60afd3c7e9ebaaf70fad4a4beb75cf8740ac959017a31e7006c7486%40%3Cdev.lucene.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r42ac3e39e6265db12d9fc6ae1cd4b5fea7aed9830dc6f6d58228fed7%40%3Ccommits.cassandra.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r68acf97f4526ba59a33cc6e592261ea4f85d890f99e79c82d57dd589%40%3Cissues.spark.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/rf7f87810c38dc9abf9f93989f76008f504cbf7c1a355214640b2d04c%40%3Ccommits.cassandra.apache.org%3E cve-icon cve-icon
https://lists.debian.org/debian-lts-announce/2020/01/msg00037.html cve-icon cve-icon
https://lists.debian.org/debian-lts-announce/2020/08/msg00039.html cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2017-7525 cve-icon
https://security.netapp.com/advisory/ntap-20171214-0002/ cve-icon cve-icon
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03902en_us cve-icon cve-icon
https://www.cve.org/CVERecord?id=CVE-2017-7525 cve-icon
https://www.debian.org/security/2017/dsa-4004 cve-icon cve-icon
https://www.oracle.com/security-alerts/cpuoct2020.html cve-icon cve-icon
https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html cve-icon cve-icon
https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html cve-icon cve-icon
https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html cve-icon cve-icon
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
CPEs cpe:/a:redhat:jboss_enterprise_application_platform:7.1::el7
Weaknesses

Sources

Status
PUBLISHED
Assigner
redhat
Published
Updated
Oct 8, 2026, 9:13 PM
Reserved
Apr 5, 2017, 12:00 AM

View source JSON

Updated
Aug 5, 2024, 4:04 PM

JSON

Status
Modified
Published
Feb 6, 2018, 3:29 PM
Modified
Oct 8, 2026, 10:16 PM

View source JSON

Severity
Important
Public date
Jul 14, 2017, 12:00 AM

View source Bugzilla JSON

No data.