CVE-2017-15095

Published: Feb 6, 2018Modified: Nov 21, 2024

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaw CVE-2017-7525 by blacklisting more classes that could be used maliciously.

Affected (52)

Products: Fasterxml: Jackson Databind · Debian: Debian Linux · Redhat: Openshift Container Platform, Satellite, Satellite Capsule, Jboss Enterprise Application Platform · +2 more

Show all products

1 product

1 product

4 products

Openshift Container Platform

Satellite

Satellite Capsule

Jboss Enterprise Application Platform

Netapp

4 products

Oncommand Balance

Oncommand Performance Manager

14 products

Communications Billing And Revenue Management

Communications Diameter Signaling Router

Communications Instant Messaging Server

Database Server

Enterprise Manager For Virtualization

Financial Services Analytical Applications Infrastructure

Global Lifecycle Management Opatchauto

Identity Manager

Jd Edwards Enterpriseone Tools

Primavera Unifier

Utilities Advanced Spatial And Operational Analytics

Webcenter Portal

Configuration A

8 vulnerable

Vulnerable Software	Affected Versions
Fasterxml Jackson Databind	From 2.0.0 to 2.6.7.2
Fasterxml Jackson Databind	From 2.7.0 to 2.7.9.2
Fasterxml Jackson Databind	From 2.8.0 to 2.8.10
Fasterxml Jackson Databind	Version 2.9.0
Fasterxml Jackson Databind	Version 2.9.0 prerelease1
Fasterxml Jackson Databind	Version 2.9.0 prerelease2
Fasterxml Jackson Databind	Version 2.9.0 prerelease3
Fasterxml Jackson Databind	Version 2.9.0 prerelease4

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 8.0
Debian Debian Linux	Version 9.0

Configuration C

3 vulnerable

Vulnerable Software	Affected Versions
Redhat Openshift Container Platform	Version 3.11
Redhat Satellite	Version 6.4
Redhat Satellite Capsule	Version 6.4

Configuration D

1 vulnerable

Vulnerable Software	Affected Versions
Redhat Openshift Container Platform	Version 4.1

Configuration E

2 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Redhat Jboss Enterprise Application Platform	Version 6.0.0
Redhat Jboss Enterprise Application Platform	Version 6.4.0

Running on/with	Platform Versions
Redhat Enterprise Linux	Version 5.0

Configuration F

1 vulnerable · 2 platform

Vulnerable Software	Affected Versions
Redhat Jboss Enterprise Application Platform	Version 7.1.0

Running on/with	Platform Versions
Redhat Enterprise Linux	Version 6.0
Redhat Enterprise Linux	Version 7.0

Configuration G

5 vulnerable

Vulnerable Software	Affected Versions
Netapp Oncommand Balance	All versions
Netapp Oncommand Performance Manager	All versions
Netapp Oncommand Performance Manager	All versions
Netapp Oncommand Shift	All versions
Netapp Snapcenter	All versions

Configuration H

30 vulnerable

Vulnerable Software	Affected Versions
Oracle Banking Platform	Version 2.5.0
Oracle Banking Platform	Version 2.6.0
Oracle Banking Platform	Version 2.6.1
Oracle Banking Platform	Version 2.6.2
Oracle Clusterware	Version 12.1.0.2.0
Oracle Communications Billing And Revenue Management	Version 12.0
Oracle Communications Billing And Revenue Management	Version 7.5
Oracle Communications Diameter Signaling Router	Before 8.3
Oracle Communications Instant Messaging Server	Version 10.0.1.2.0
Oracle Database Server	Version 12.2.0.1
Oracle Database Server	Version 18.1
Oracle Enterprise Manager For Virtualization	Version 13.2.2
Oracle Enterprise Manager For Virtualization	Version 13.2.3
Oracle Enterprise Manager For Virtualization	Version 13.3.1
Oracle Financial Services Analytical Applications Infrastructure	Version 8.0.2
Oracle Financial Services Analytical Applications Infrastructure	Version 8.0.3
Oracle Financial Services Analytical Applications Infrastructure	Version 8.0.4
Oracle Financial Services Analytical Applications Infrastructure	Version 8.0.5
Oracle Financial Services Analytical Applications Infrastructure	Version 8.0.6
Oracle Financial Services Analytical Applications Infrastructure	Version 8.0.7
Oracle Global Lifecycle Management Opatchauto	Before 12.2.0.1.14
Oracle Identity Manager	Version 11.1.2.3.0
Oracle Identity Manager	Version 12.2.1.3.0
Oracle Jd Edwards Enterpriseone Tools	Version 9.2
Oracle Primavera Unifier	From 17.1 to 17.12
Oracle Primavera Unifier	Version 16.1
Oracle Primavera Unifier	Version 16.2
Oracle Primavera Unifier	Version 18.8
Oracle Utilities Advanced Spatial And Operational Analytics	Version 2.7.0.1
Oracle Webcenter Portal	Version 12.2.1.3.0

Related CWEs

CWE-184

Incomplete List of Disallowed Inputs

The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete, leading to resultant weaknesses.

CWE-502

Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

References (64)

http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html

Source: secalert@redhat.com

PatchThird Party Advisory

http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html

Source: secalert@redhat.com

PatchThird Party Advisory

http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html

Source: secalert@redhat.com

PatchThird Party Advisory

http://www.securityfocus.com/bid/103880

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://www.securitytracker.com/id/1039769

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

https://access.redhat.com/errata/RHSA-2017:3189

Source: secalert@redhat.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2017:3190

Source: secalert@redhat.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:0342

Source: secalert@redhat.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:0478

Source: secalert@redhat.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:0479

Source: secalert@redhat.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:0480

Source: secalert@redhat.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:0481

Source: secalert@redhat.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:0576

Source: secalert@redhat.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:0577

Source: secalert@redhat.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:1447

Source: secalert@redhat.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:1448

Source: secalert@redhat.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:1449

Source: secalert@redhat.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:1450

Source: secalert@redhat.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:1451

Source: secalert@redhat.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:2927

Source: secalert@redhat.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:2858

Source: secalert@redhat.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:3149

Source: secalert@redhat.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:3892

Source: secalert@redhat.com

Third Party Advisory

https://github.com/FasterXML/jackson-databind/issues/1680

Source: secalert@redhat.com

Issue TrackingThird Party Advisory

https://github.com/FasterXML/jackson-databind/issues/1737

Source: secalert@redhat.com

Issue TrackingPatchThird Party Advisory

https://lists.apache.org/thread.html/f095a791bda6c0595f691eddd0febb2d396987eec5cbd29120d8c629%40%3Csolr-user.lucene.apache.org%3E

Source: secalert@redhat.com

https://lists.debian.org/debian-lts-announce/2020/01/msg00037.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

https://security.netapp.com/advisory/ntap-20171214-0003/

Source: secalert@redhat.com

Third Party Advisory

https://www.debian.org/security/2017/dsa-4037

Source: secalert@redhat.com

Third Party Advisory

https://www.oracle.com/security-alerts/cpuoct2020.html

Source: secalert@redhat.com

Third Party Advisory

https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html

Source: secalert@redhat.com

PatchThird Party Advisory

https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html

Source: secalert@redhat.com

PatchThird Party Advisory

http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html