CVE-2017-7525

Published: Feb 6, 2018Modified: Nov 21, 2024

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.

Affected (46)

Products: Fasterxml: Jackson Databind · Debian: Debian Linux · Netapp: Oncommand Balance, Oncommand Performance Manager, Oncommand Shift, Snapcenter · +2 more

Show all products

1 product

1 product

4 products

Oncommand Performance Manager

Oncommand Shift

Snapcenter

Redhat

4 products

Openshift Container Platform

Virtualization

Virtualization Host

Jboss Enterprise Application Platform

Oracle

11 products

Banking Platform

Communications Billing And Revenue Management

Communications Communications Policy Management

Communications Diameter Signaling Route

Communications Instant Messaging Server

Enterprise Manager For Virtualization

Financial Services Analytical Applications Infrastructure

Global Lifecycle Management Opatchauto

Primavera Unifier

Utilities Advanced Spatial And Operational Analytics

Webcenter Portal

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Fasterxml Jackson Databind	Before 2.6.7.1
Fasterxml Jackson Databind	From 2.7.0 to 2.7.9.1
Fasterxml Jackson Databind	From 2.8.0 to 2.8.9
Fasterxml Jackson Databind	Version 2.9.0 prerelease1
Fasterxml Jackson Databind	Version 2.9.0 prerelease2

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 8.0
Debian Debian Linux	Version 9.0

Configuration C

5 vulnerable

Vulnerable Software	Affected Versions
Netapp Oncommand Balance	All versions
Netapp Oncommand Performance Manager	All versions
Netapp Oncommand Performance Manager	All versions
Netapp Oncommand Shift	All versions
Netapp Snapcenter	All versions

Configuration D

3 vulnerable

Vulnerable Software	Affected Versions
Redhat Openshift Container Platform	Version 4.1
Redhat Virtualization	Version 4.0
Redhat Virtualization Host	Version 4.0

Configuration E

2 vulnerable · 2 platform

Vulnerable Software	Affected Versions
Redhat Jboss Enterprise Application Platform	Version 7.0
Redhat Jboss Enterprise Application Platform	Version 7.1

Running on/with	Platform Versions
Redhat Enterprise Linux Server	Version 6.0
Redhat Enterprise Linux Server	Version 7.0

Configuration F

2 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Redhat Jboss Enterprise Application Platform	Version 6.0.0
Redhat Jboss Enterprise Application Platform	Version 6.4.0

Running on/with	Platform Versions
Redhat Enterprise Linux Server	Version 5.0

Configuration G

1 vulnerable

Vulnerable Software	Affected Versions
Redhat Openshift Container Platform	Version 3.11

Configuration H

26 vulnerable

Vulnerable Software	Affected Versions
Oracle Banking Platform	Version 2.5.0
Oracle Banking Platform	Version 2.6.0
Oracle Banking Platform	Version 2.6.1
Oracle Banking Platform	Version 2.6.2
Oracle Communications Billing And Revenue Management	Version 12.0
Oracle Communications Billing And Revenue Management	Version 7.5
Oracle Communications Communications Policy Management	From 12.0 to 12.5.2
Oracle Communications Diameter Signaling Route	Before 8.3
Oracle Communications Instant Messaging Server	Version 10.0.1.2.0
Oracle Communications Instant Messaging Server	Version 10.0.1
Oracle Enterprise Manager For Virtualization	Version 13.2.2
Oracle Enterprise Manager For Virtualization	Version 13.2.3
Oracle Enterprise Manager For Virtualization	Version 13.3.1
Oracle Financial Services Analytical Applications Infrastructure	Version 8.0.2.0.0
Oracle Financial Services Analytical Applications Infrastructure	Version 8.0.3.0.0
Oracle Financial Services Analytical Applications Infrastructure	Version 8.0.4.0.0
Oracle Financial Services Analytical Applications Infrastructure	Version 8.0.5.0.0
Oracle Financial Services Analytical Applications Infrastructure	Version 8.0.6.0.0
Oracle Financial Services Analytical Applications Infrastructure	Version 8.0.7.0.0
Oracle Global Lifecycle Management Opatchauto	Before 12.2.0.1.14
Oracle Primavera Unifier	From 17.1 to 17.12
Oracle Primavera Unifier	Version 16.1
Oracle Primavera Unifier	Version 16.2
Oracle Primavera Unifier	Version 18.8
Oracle Utilities Advanced Spatial And Operational Analytics	Version 2.7.0.1
Oracle Webcenter Portal	Version 12.2.1.3.0

Related CWEs

CWE-184

Incomplete List of Disallowed Inputs

The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete, leading to resultant weaknesses.

CWE-502

Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

References (120)

http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html

Source: secalert@redhat.com

PatchThird Party Advisory

http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html

Source: secalert@redhat.com

PatchThird Party Advisory

http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html

Source: secalert@redhat.com

PatchThird Party Advisory

http://www.securityfocus.com/bid/99623

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://www.securitytracker.com/id/1039744

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://www.securitytracker.com/id/1039947

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://www.securitytracker.com/id/1040360

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

https://access.redhat.com/errata/RHSA-2017:1834

Source: secalert@redhat.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2017:1835

Source: secalert@redhat.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2017:1836

Source: secalert@redhat.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2017:1837

Source: secalert@redhat.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2017:1839

Source: secalert@redhat.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2017:1840

Source: secalert@redhat.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2017:2477

Source: secalert@redhat.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2017:2546

Source: secalert@redhat.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2017:2547

Source: secalert@redhat.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2017:2633

Source: secalert@redhat.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2017:2635

Source: secalert@redhat.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2017:2636

Source: secalert@redhat.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2017:2637

Source: secalert@redhat.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2017:2638

Source: secalert@redhat.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2017:3141

Source: secalert@redhat.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2017:3454

Source: secalert@redhat.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2017:3455

Source: secalert@redhat.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2017:3456

Source: secalert@redhat.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2017:3458

Source: secalert@redhat.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:0294

Source: secalert@redhat.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:0342

Source: secalert@redhat.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:1449

Source: secalert@redhat.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:1450

Source: secalert@redhat.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:0910

Source: secalert@redhat.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:2858

Source: secalert@redhat.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:3149

Source: secalert@redhat.com

Third Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=1462702

Source: secalert@redhat.com

Issue TrackingThird Party Advisory

https://cwiki.apache.org/confluence/display/WW/S2-055

Source: secalert@redhat.com

Third Party Advisory

https://github.com/FasterXML/jackson-databind/issues/1599

Source: secalert@redhat.com

Issue TrackingPatchThird Party Advisory

https://github.com/FasterXML/jackson-databind/issues/1723

Source: secalert@redhat.com

Issue TrackingThird Party Advisory

https://lists.apache.org/thread.html/3c87dc8bca99a2b3b4743713b33d1de05b1d6b761fdf316224e9c81f%40%3Cdev.lucene.apache.org%3E

Source: secalert@redhat.com

https://lists.apache.org/thread.html/4641ed8616ccc2c1fbddac2c3dc9900c96387bc226eaf0232d61909b%40%3Ccommits.cassandra.apache.org%3E

Source: secalert@redhat.com

https://lists.apache.org/thread.html/5008bcbd45ee65ce39e4220b6ac53d28a24d6bc67d5804e9773a7399%40%3Csolr-user.lucene.apache.org%3E

Source: secalert@redhat.com

https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451%40%3Csolr-user.lucene.apache.org%3E

Source: secalert@redhat.com

https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe%40%3Ccommits.druid.apache.org%3E

Source: secalert@redhat.com

https://lists.apache.org/thread.html/b1f33fe5ade396bb903fdcabe9f243f7692c7dfce5418d3743c2d346%40%3Cdev.lucene.apache.org%3E

Source: secalert@redhat.com

https://lists.apache.org/thread.html/c10a2bf0fdc3d25faf17bd191d6ec46b29a353fa9c97bebd7c4e5913%40%3Cdev.lucene.apache.org%3E

Source: secalert@redhat.com

https://lists.apache.org/thread.html/c2ed4c0126b43e324cf740012a0edd371fd36096fd777be7bfe7a2a6%40%3Cdev.lucene.apache.org%3E

Source: secalert@redhat.com

https://lists.apache.org/thread.html/c9d5ff20929e8a3c8794facf4c4b326a9c10618812eec356caa20b87%40%3Csolr-user.lucene.apache.org%3E

Source: secalert@redhat.com

https://lists.apache.org/thread.html/f095a791bda6c0595f691eddd0febb2d396987eec5cbd29120d8c629%40%3Csolr-user.lucene.apache.org%3E

Source: secalert@redhat.com

https://lists.apache.org/thread.html/f60afd3c7e9ebaaf70fad4a4beb75cf8740ac959017a31e7006c7486%40%3Cdev.lucene.apache.org%3E

Source: secalert@redhat.com

https://lists.apache.org/thread.html/r42ac3e39e6265db12d9fc6ae1cd4b5fea7aed9830dc6f6d58228fed7%40%3Ccommits.cassandra.apache.org%3E

Source: secalert@redhat.com

https://lists.apache.org/thread.html/r68acf97f4526ba59a33cc6e592261ea4f85d890f99e79c82d57dd589%40%3Cissues.spark.apache.org%3E

Source: secalert@redhat.com

https://lists.apache.org/thread.html/rf7f87810c38dc9abf9f93989f76008f504cbf7c1a355214640b2d04c%40%3Ccommits.cassandra.apache.org%3E

Source: secalert@redhat.com

https://lists.debian.org/debian-lts-announce/2020/01/msg00037.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

https://lists.debian.org/debian-lts-announce/2020/08/msg00039.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

https://security.netapp.com/advisory/ntap-20171214-0002/

Source: secalert@redhat.com

Third Party Advisory

https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03902en_us

Source: secalert@redhat.com

Third Party Advisory

https://www.debian.org/security/2017/dsa-4004

Source: secalert@redhat.com

Third Party Advisory

https://www.oracle.com/security-alerts/cpuoct2020.html

Source: secalert@redhat.com

Third Party Advisory

https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html

Source: secalert@redhat.com

PatchThird Party Advisory

https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html

Source: secalert@redhat.com

PatchThird Party Advisory

https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html

Source: secalert@redhat.com

PatchThird Party Advisory

http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html