jackson-databind is vulnerable to a deserialization flaw
A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2017-7525US | critical9.8 | Exploit | ||
A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by se… | ||||
02
references
External citations — patches, advisories, analysis.
- http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.htmlWEB
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.htmlWEB
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.htmlWEB
- https://access.redhat.com/errata/RHSA-2017:1834WEB
- https://access.redhat.com/errata/RHSA-2017:1835WEB
- https://access.redhat.com/errata/RHSA-2017:1836WEB
- https://access.redhat.com/errata/RHSA-2017:1837WEB
- https://access.redhat.com/errata/RHSA-2017:1839WEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan