{"id":"CVE-2017-15095","title":"A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of th…","summary":"A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of th…","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-184","CWE-502"],"vendor":"fasterxml","product":"jackson-databind","affected":["jackson-databind >= 2.0.0, < 2.6.7.2","jackson-databind >= 2.7.0, < 2.7.9.2","jackson-databind >= 2.8.0, < 2.8.10","jackson-databind = 2.9.0","debian_linux = 8.0","debian_linux = 9.0","openshift_container_platform = 3.11","satellite = 6.4","satellite_capsule = 6.4","openshift_container_platform = 4.1","jboss_enterprise_application_platform = 6.0.0","jboss_enterprise_application_platform = 6.4.0","jboss_enterprise_application_platform = 7.1.0","oncommand_balance","oncommand_performance_manager","oncommand_shift","snapcenter","banking_platform = 2.5.0","banking_platform = 2.6.0","banking_platform = 2.6.1","banking_platform = 2.6.2","clusterware = 12.1.0.2.0","communications_billing_and_revenue_management = 7.5","communications_billing_and_revenue_management = 12.0","communications_diameter_signaling_router < 8.3","communications_instant_messaging_server = 10.0.1.2.0","database_server = 12.2.0.1","database_server = 18.1","enterprise_manager_for_virtualization = 13.2.2","enterprise_manager_for_virtualization = 13.2.3","enterprise_manager_for_virtualization = 13.3.1","financial_services_analytical_applications_infrastructure = 8.0.2","financial_services_analytical_applications_infrastructure = 8.0.3","financial_services_analytical_applications_infrastructure = 8.0.4","financial_services_analytical_applications_infrastructure = 8.0.5","financial_services_analytical_applications_infrastructure = 8.0.6","financial_services_analytical_applications_infrastructure = 8.0.7","global_lifecycle_management_opatchauto < 12.2.0.1.14","identity_manager = 11.1.2.3.0","identity_manager = 12.2.1.3.0","jd_edwards_enterpriseone_tools = 9.2","primavera_unifier >= 17.1, <= 17.12","primavera_unifier = 16.1","primavera_unifier = 16.2","primavera_unifier = 18.8","utilities_advanced_spatial_and_operational_analytics = 2.7.0.1","webcenter_portal = 12.2.1.3.0"],"patched":["jackson-databind 2.8.10","communications_diameter_signaling_router 8.3","global_lifecycle_management_opatchauto 12.2.0.1.14"],"published":"2018-02-06","updated":"2026-10-08","sourceUpdated":"2026-10-08T22:16:40.377","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2017-15095","references":[{"url":"http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","label":"secalert@redhat.com"},{"url":"http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","label":"secalert@redhat.com"},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","label":"secalert@redhat.com"},{"url":"http://www.securityfocus.com/bid/103880","label":"secalert@redhat.com"},{"url":"http://www.securitytracker.com/id/1039769","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2017:3189","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2017:3190","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2018:0342","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2018:0478","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2018:0479","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2018:0480","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2018:0481","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2018:0576","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2018:0577","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2018:1447","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2018:1448","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2018:1449","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2018:1450","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2018:1451","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2018:2927","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2019:2858","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2019:3149","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2019:3892","label":"secalert@redhat.com"},{"url":"https://github.com/FasterXML/jackson-databind/issues/1680","label":"secalert@redhat.com"},{"url":"https://github.com/FasterXML/jackson-databind/issues/1737","label":"secalert@redhat.com"},{"url":"https://lists.apache.org/thread.html/f095a791bda6c0595f691eddd0febb2d396987eec5cbd29120d8c629%40%3Csolr-user.lucene.apache.org%3E","label":"secalert@redhat.com"},{"url":"https://lists.debian.org/debian-lts-announce/2020/01/msg00037.html","label":"secalert@redhat.com"},{"url":"https://security.netapp.com/advisory/ntap-20171214-0003/","label":"secalert@redhat.com"},{"url":"https://www.debian.org/security/2017/dsa-4037","label":"secalert@redhat.com"},{"url":"https://www.oracle.com/security-alerts/cpuoct2020.html","label":"secalert@redhat.com"},{"url":"https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","label":"secalert@redhat.com"},{"url":"https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","label":"secalert@redhat.com"},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securityfocus.com/bid/103880","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securitytracker.com/id/1039769","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2017:3189","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2017:3190","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2018:0342","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2018:0478","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2018:0479","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2018:0480","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2018:0481","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2018:0576","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2018:0577","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2018:1447","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2018:1448","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2018:1449","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2018:1450","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2018:1451","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2018:2927","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2019:2858","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2019:3149","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2019:3892","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/FasterXML/jackson-databind/issues/1680","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/FasterXML/jackson-databind/issues/1737","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.apache.org/thread.html/f095a791bda6c0595f691eddd0febb2d396987eec5cbd29120d8c629%40%3Csolr-user.lucene.apache.org%3E","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2020/01/msg00037.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.netapp.com/advisory/ntap-20171214-0003/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.debian.org/security/2017/dsa-4037","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpuoct2020.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","label":"af854a3a-2127-422b-91ae-364da2661108"}],"tags":["nvd"],"epss":0.08357,"epssPercentile":0.9483,"ingestedAt":"2026-10-08T23:16:47.287Z","slug":"CVE-2017-15095","body":"## Overview\n\nA deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaw CVE-2017-7525 by blacklisting more classes that could be used maliciously.\n\n## Affected\n\n- `jackson-databind >= 2.0.0, < 2.6.7.2`\n- `jackson-databind >= 2.7.0, < 2.7.9.2`\n- `jackson-databind >= 2.8.0, < 2.8.10`\n- `jackson-databind = 2.9.0`\n- `debian_linux = 8.0`\n- `debian_linux = 9.0`\n- `openshift_container_platform = 3.11`\n- `satellite = 6.4`\n- `satellite_capsule = 6.4`\n- `openshift_container_platform = 4.1`\n- `jboss_enterprise_application_platform = 6.0.0`\n- `jboss_enterprise_application_platform = 6.4.0`\n- `jboss_enterprise_application_platform = 7.1.0`\n- `oncommand_balance`\n- `oncommand_performance_manager`\n- `oncommand_shift`\n- `snapcenter`\n- `banking_platform = 2.5.0`\n- `banking_platform = 2.6.0`\n- `banking_platform = 2.6.1`\n- `banking_platform = 2.6.2`\n- `clusterware = 12.1.0.2.0`\n- `communications_billing_and_revenue_management = 7.5`\n- `communications_billing_and_revenue_management = 12.0`\n- `communications_diameter_signaling_router < 8.3`\n- `communications_instant_messaging_server = 10.0.1.2.0`\n- `database_server = 12.2.0.1`\n- `database_server = 18.1`\n- `enterprise_manager_for_virtualization = 13.2.2`\n- `enterprise_manager_for_virtualization = 13.2.3`\n- `enterprise_manager_for_virtualization = 13.3.1`\n- `financial_services_analytical_applications_infrastructure = 8.0.2`\n- `financial_services_analytical_applications_infrastructure = 8.0.3`\n- `financial_services_analytical_applications_infrastructure = 8.0.4`\n- `financial_services_analytical_applications_infrastructure = 8.0.5`\n- `financial_services_analytical_applications_infrastructure = 8.0.6`\n- `financial_services_analytical_applications_infrastructure = 8.0.7`\n- `global_lifecycle_management_opatchauto < 12.2.0.1.14`\n- `identity_manager = 11.1.2.3.0`\n- `identity_manager = 12.2.1.3.0`\n- `jd_edwards_enterpriseone_tools = 9.2`\n- `primavera_unifier >= 17.1, <= 17.12`\n- `primavera_unifier = 16.1`\n- `primavera_unifier = 16.2`\n- `primavera_unifier = 18.8`\n- `utilities_advanced_spatial_and_operational_analytics = 2.7.0.1`\n- `webcenter_portal = 12.2.1.3.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `jackson-databind 2.8.10`\n- `communications_diameter_signaling_router 8.3`\n- `global_lifecycle_management_opatchauto 12.2.0.1.14`","depth":"midnight","depthScore":56,"depthScoreParts":{"impact":53.9,"likelihood":1.7,"exploitation":0,"ransomware":0},"changes":[]}