VDB
CVE-2017-15095
CVE-2017-15095
PUBLISHED
A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaw CVE-2017-7525 by blacklisting more classes that could be used maliciously.
EPSS 7.89% · 92.2th percentile
Risk Scores
EPSS Score
7.89%
92.2th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ubuntu:20.04:LTS | libjackson-json-java | 0, 1.9.13-1 |
| Ubuntu:Pro:16.04:LTS | jackson-databind | 2.4.2-2, 2.4.2-3, 0 |
| Ubuntu:Pro:14.04:LTS | jackson-databind | 2.2.2-1, 0 |
| Ubuntu:Pro:14.04:LTS | libjackson-json-java | 1.9.2-3, 1.9.2-1, 1.9.2-2 |
| Ubuntu:18.04:LTS | libjackson-json-java | 0, 1.9.2-9, * |
| Ubuntu:16.04:LTS | libjackson-json-java | 0, 1.9.2-5, 1.9.2-7 |
Exploit Intelligence
- Struts2の脆弱性S2-045, S2-055 および Jackson の脆弱性 CVE-2017-7525, CVE-2017-15095 の調査報告 (github-poc-repo)
- Struts2の脆弱性S2-045, S2-055 および Jackson の脆弱性 CVE-2017-7525, CVE-2017-15095 の調査報告 (github-poc-repo)
- Struts2の脆弱性S2-045, S2-055 および Jackson の脆弱性 CVE-2017-7525, CVE-2017-15095 の調査報告 (github-poc-repo)
- Struts2の脆弱性S2-045, S2-055 および Jackson の脆弱性 CVE-2017-7525, CVE-2017-15095 の調査報告 (github-poc-repo)
- Struts2の脆弱性S2-045, S2-055 および Jackson の脆弱性 CVE-2017-7525, CVE-2017-15095 の調査報告 (github-poc-repo)
- Struts2の脆弱性S2-045, S2-055 および Jackson の脆弱性 CVE-2017-7525, CVE-2017-15095 の調査報告 (github-poc-repo)
- Struts2の脆弱性S2-045, S2-055 および Jackson の脆弱性 CVE-2017-7525, CVE-2017-15095 の調査報告 (github-poc-repo)
- Struts2の脆弱性S2-045, S2-055 および Jackson の脆弱性 CVE-2017-7525, CVE-2017-15095 の調査報告 (github-poc-repo)
- Struts2の脆弱性S2-045, S2-055 および Jackson の脆弱性 CVE-2017-7525, CVE-2017-15095 の調査報告 (github-poc-repo)
Timeline
- Feb 6, 2018 CVE Published
- Sep 27, 2019 CVE Updated
- Apr 14, 2021 EPSS Score
- Nov 3, 2022 EPSS Score
- Mar 7, 2023 EPSS Score
- Nov 8, 2023 EPSS Score
- Jul 9, 2024 EPSS Score
- Aug 10, 2024 EPSS Score
- Sep 17, 2024 EPSS Score
- Feb 18, 2025 EPSS Score
- Mar 17, 2025 EPSS Score
- Mar 26, 2025 EPSS Score
References
- https://ubuntu.com/security/CVE-2017-15095 third-party-advisory
- https://github.com/FasterXML/jackson-databind/commit/3bfbb835 third-party-advisory
- https://github.com/FasterXML/jackson-databind/issues/1680 third-party-advisory
- https://github.com/FasterXML/jackson-databind/issues/1723 third-party-advisory
- https://github.com/FasterXML/jackson-databind/issues/1737 third-party-advisory
- https://github.com/FasterXML/jackson-databind/commit/e8f043d1 third-party-advisory
- https://github.com/FasterXML/jackson-databind/commit/ddfddfba third-party-advisory
- https://github.com/FasterXML/jackson-databind/blob/7093008aa2afe8068e120df850189ae072dfa1b2/src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java#L43 third-party-advisory
- https://ubuntu.com/security/notices/USN-4741-1 vendor-advisory
- https://www.cve.org/CVERecord?id=CVE-2017-15095 third-party-advisory