CVE-2017-17485

Published: Jan 10, 2018Modified: Aug 27, 2025

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the Spring libraries are available in the classpath.

Affected (15)

Products: Fasterxml: Jackson Databind · Debian: Debian Linux · Redhat: Jboss Enterprise Application Platform, Openshift Container Platform · +1 more

Show all products

Fasterxml: Jackson Databind · Debian: Debian Linux · Redhat: Jboss Enterprise Application Platform, Openshift Container Platform · Netapp: E Series Santricity Os Controller, E Series Santricity Web Services Proxy, Oncommand Shift, Snapcenter

1 product

1 product

2 products

Jboss Enterprise Application Platform

Openshift Container Platform

Netapp

4 products

E Series Santricity Os Controller

E Series Santricity Web Services Proxy

Oncommand Shift

Snapcenter

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Fasterxml Jackson Databind	Before 2.6.7.3
Fasterxml Jackson Databind	From 2.7.0 to 2.7.9.2
Fasterxml Jackson Databind	From 2.8.0 to 2.8.11
Fasterxml Jackson Databind	From 2.9.0 to 2.9.4

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 8.0
Debian Debian Linux	Version 9.0

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Redhat Jboss Enterprise Application Platform	Version 7.1

Running on/with	Platform Versions
Redhat Enterprise Linux Server	Version 6.0

Configuration D

2 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Redhat Jboss Enterprise Application Platform	Version 6.0.0
Redhat Jboss Enterprise Application Platform	Version 6.4.0

Running on/with	Platform Versions
Redhat Enterprise Linux Server	Version 5.0

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Redhat Openshift Container Platform	Version 4.1

Running on/with	Platform Versions
Redhat Enterprise Linux Server	Version 7.0

Configuration F

1 vulnerable

Vulnerable Software	Affected Versions
Redhat Openshift Container Platform	Version 3.11

Configuration G

4 vulnerable

Vulnerable Software	Affected Versions
Netapp E Series Santricity Os Controller	From 11.0.0 to 11.60.3
Netapp E Series Santricity Web Services Proxy	All versions
Netapp Oncommand Shift	All versions
Netapp Snapcenter	All versions

Related CWEs

CWE-502

Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

References (48)

http://www.securityfocus.com/archive/1/541652/100/0/threaded

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

https://access.redhat.com/errata/RHSA-2018:0116

Source: cve@mitre.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:0342

Source: cve@mitre.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:0478

Source: cve@mitre.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:0479

Source: cve@mitre.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:0480

Source: cve@mitre.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:0481

Source: cve@mitre.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:1447

Source: cve@mitre.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:1448

Source: cve@mitre.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:1449

Source: cve@mitre.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:1450

Source: cve@mitre.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:1451

Source: cve@mitre.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:2930

Source: cve@mitre.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:1782

Source: cve@mitre.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:1797

Source: cve@mitre.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:2858

Source: cve@mitre.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:3149

Source: cve@mitre.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:3892

Source: cve@mitre.org

Third Party Advisory

https://github.com/FasterXML/jackson-databind/issues/1855

Source: cve@mitre.org

Third Party Advisory

https://github.com/irsl/jackson-rce-via-spel/

Source: cve@mitre.org

Third Party Advisory

https://security.netapp.com/advisory/ntap-20180201-0003/

Source: cve@mitre.org

Third Party Advisory

https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03902en_us

Source: cve@mitre.org

Third Party Advisory

https://www.debian.org/security/2018/dsa-4114

Source: cve@mitre.org

Third Party Advisory

https://www.oracle.com/security-alerts/cpuoct2020.html

Source: cve@mitre.org

Third Party Advisory

http://www.securityfocus.com/archive/1/541652/100/0/threaded