CVE-2017-15095

unknown

Published 2018-10-18 · Modified 2024-03-15

CVSS v3

—

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2

—

VIR risk

—

Description

A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaw CVE-2017-7525 by blacklisting more classes that could be used maliciously.

Predictions

Exploit likelihood

30%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: debian — https://security-tracker.debian.org/tracker/CVE-2017-15095

OS impact

OS	Version	Status	Fixed in
debian	bookworm	fixed	`2.9.1-1`
debian	bullseye	fixed	`2.9.1-1`
debian	forky	fixed	`2.9.1-1`
debian	sid	fixed	`2.9.1-1`
debian	trixie	fixed	`2.9.1-1`

Package impact

Ecosystem	Package	Vulnerable	Fixed
Maven	com.fasterxml.jackson.core:jackson-databind	`>=2.8.0,<2.8.11`	`2.8.11`
Maven	com.fasterxml.jackson.core:jackson-databind	`>=2.9.0,<2.9.4`	`2.9.4`
Maven	com.fasterxml.jackson.core:jackson-databind	`>=2.0.0,<2.6.7.3`	`2.6.7.3`
Maven	com.fasterxml.jackson.core:jackson-databind	`>=2.7.0,<2.7.9.2`	`2.7.9.2`

References

Verify integrity in audit chain (admin only). AS-IS.