--- id: CVE-2017-15095 title: >- A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of th… summary: >- A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of th… severity: critical cvss: 9.8 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H' cwe: - CWE-184 - CWE-502 vendor: fasterxml product: jackson-databind affected: - 'jackson-databind >= 2.0.0, < 2.6.7.2' - 'jackson-databind >= 2.7.0, < 2.7.9.2' - 'jackson-databind >= 2.8.0, < 2.8.10' - jackson-databind = 2.9.0 - debian_linux = 8.0 - debian_linux = 9.0 - openshift_container_platform = 3.11 - satellite = 6.4 - satellite_capsule = 6.4 - openshift_container_platform = 4.1 - jboss_enterprise_application_platform = 6.0.0 - jboss_enterprise_application_platform = 6.4.0 - jboss_enterprise_application_platform = 7.1.0 - oncommand_balance - oncommand_performance_manager - oncommand_shift - snapcenter - banking_platform = 2.5.0 - banking_platform = 2.6.0 - banking_platform = 2.6.1 - banking_platform = 2.6.2 - clusterware = 12.1.0.2.0 - communications_billing_and_revenue_management = 7.5 - communications_billing_and_revenue_management = 12.0 - communications_diameter_signaling_router < 8.3 - communications_instant_messaging_server = 10.0.1.2.0 - database_server = 12.2.0.1 - database_server = 18.1 - enterprise_manager_for_virtualization = 13.2.2 - enterprise_manager_for_virtualization = 13.2.3 - enterprise_manager_for_virtualization = 13.3.1 - financial_services_analytical_applications_infrastructure = 8.0.2 - financial_services_analytical_applications_infrastructure = 8.0.3 - financial_services_analytical_applications_infrastructure = 8.0.4 - financial_services_analytical_applications_infrastructure = 8.0.5 - financial_services_analytical_applications_infrastructure = 8.0.6 - financial_services_analytical_applications_infrastructure = 8.0.7 - global_lifecycle_management_opatchauto < 12.2.0.1.14 - identity_manager = 11.1.2.3.0 - identity_manager = 12.2.1.3.0 - jd_edwards_enterpriseone_tools = 9.2 - 'primavera_unifier >= 17.1, <= 17.12' - primavera_unifier = 16.1 - primavera_unifier = 16.2 - primavera_unifier = 18.8 - utilities_advanced_spatial_and_operational_analytics = 2.7.0.1 - webcenter_portal = 12.2.1.3.0 patched: - jackson-databind 2.8.10 - communications_diameter_signaling_router 8.3 - global_lifecycle_management_opatchauto 12.2.0.1.14 published: '2018-02-06' updated: '2026-10-08' sourceUpdated: '2026-10-08T22:16:40.377' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2017-15095' references: - url: >- http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html label: secalert@redhat.com - url: >- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html label: secalert@redhat.com - url: >- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html label: secalert@redhat.com - url: 'http://www.securityfocus.com/bid/103880' label: secalert@redhat.com - url: 'http://www.securitytracker.com/id/1039769' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2017:3189' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2017:3190' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2018:0342' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2018:0478' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2018:0479' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2018:0480' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2018:0481' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2018:0576' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2018:0577' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2018:1447' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2018:1448' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2018:1449' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2018:1450' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2018:1451' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2018:2927' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2019:2858' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2019:3149' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2019:3892' label: secalert@redhat.com - url: 'https://github.com/FasterXML/jackson-databind/issues/1680' label: secalert@redhat.com - url: 'https://github.com/FasterXML/jackson-databind/issues/1737' label: secalert@redhat.com - url: >- https://lists.apache.org/thread.html/f095a791bda6c0595f691eddd0febb2d396987eec5cbd29120d8c629%40%3Csolr-user.lucene.apache.org%3E label: secalert@redhat.com - url: 'https://lists.debian.org/debian-lts-announce/2020/01/msg00037.html' label: secalert@redhat.com - url: 'https://security.netapp.com/advisory/ntap-20171214-0003/' label: secalert@redhat.com - url: 'https://www.debian.org/security/2017/dsa-4037' label: secalert@redhat.com - url: 'https://www.oracle.com/security-alerts/cpuoct2020.html' label: secalert@redhat.com - url: >- https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html label: secalert@redhat.com - url: >- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html label: secalert@redhat.com - url: >- http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html label: af854a3a-2127-422b-91ae-364da2661108 - url: >- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html label: af854a3a-2127-422b-91ae-364da2661108 - url: >- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html label: af854a3a-2127-422b-91ae-364da2661108 - url: 'http://www.securityfocus.com/bid/103880' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'http://www.securitytracker.com/id/1039769' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2017:3189' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2017:3190' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2018:0342' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2018:0478' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2018:0479' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2018:0480' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2018:0481' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2018:0576' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2018:0577' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2018:1447' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2018:1448' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2018:1449' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2018:1450' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2018:1451' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2018:2927' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2019:2858' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2019:3149' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2019:3892' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://github.com/FasterXML/jackson-databind/issues/1680' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://github.com/FasterXML/jackson-databind/issues/1737' label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.apache.org/thread.html/f095a791bda6c0595f691eddd0febb2d396987eec5cbd29120d8c629%40%3Csolr-user.lucene.apache.org%3E label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://lists.debian.org/debian-lts-announce/2020/01/msg00037.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://security.netapp.com/advisory/ntap-20171214-0003/' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.debian.org/security/2017/dsa-4037' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpuoct2020.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html label: af854a3a-2127-422b-91ae-364da2661108 tags: - nvd epss: 0.08357 epssPercentile: 0.9483 ingestedAt: '2026-10-08T23:16:47.287Z' --- ## Overview A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaw CVE-2017-7525 by blacklisting more classes that could be used maliciously. ## Affected - `jackson-databind >= 2.0.0, < 2.6.7.2` - `jackson-databind >= 2.7.0, < 2.7.9.2` - `jackson-databind >= 2.8.0, < 2.8.10` - `jackson-databind = 2.9.0` - `debian_linux = 8.0` - `debian_linux = 9.0` - `openshift_container_platform = 3.11` - `satellite = 6.4` - `satellite_capsule = 6.4` - `openshift_container_platform = 4.1` - `jboss_enterprise_application_platform = 6.0.0` - `jboss_enterprise_application_platform = 6.4.0` - `jboss_enterprise_application_platform = 7.1.0` - `oncommand_balance` - `oncommand_performance_manager` - `oncommand_shift` - `snapcenter` - `banking_platform = 2.5.0` - `banking_platform = 2.6.0` - `banking_platform = 2.6.1` - `banking_platform = 2.6.2` - `clusterware = 12.1.0.2.0` - `communications_billing_and_revenue_management = 7.5` - `communications_billing_and_revenue_management = 12.0` - `communications_diameter_signaling_router < 8.3` - `communications_instant_messaging_server = 10.0.1.2.0` - `database_server = 12.2.0.1` - `database_server = 18.1` - `enterprise_manager_for_virtualization = 13.2.2` - `enterprise_manager_for_virtualization = 13.2.3` - `enterprise_manager_for_virtualization = 13.3.1` - `financial_services_analytical_applications_infrastructure = 8.0.2` - `financial_services_analytical_applications_infrastructure = 8.0.3` - `financial_services_analytical_applications_infrastructure = 8.0.4` - `financial_services_analytical_applications_infrastructure = 8.0.5` - `financial_services_analytical_applications_infrastructure = 8.0.6` - `financial_services_analytical_applications_infrastructure = 8.0.7` - `global_lifecycle_management_opatchauto < 12.2.0.1.14` - `identity_manager = 11.1.2.3.0` - `identity_manager = 12.2.1.3.0` - `jd_edwards_enterpriseone_tools = 9.2` - `primavera_unifier >= 17.1, <= 17.12` - `primavera_unifier = 16.1` - `primavera_unifier = 16.2` - `primavera_unifier = 18.8` - `utilities_advanced_spatial_and_operational_analytics = 2.7.0.1` - `webcenter_portal = 12.2.1.3.0` ## Remediation Upgrade past the affected range: - `jackson-databind 2.8.10` - `communications_diameter_signaling_router 8.3` - `global_lifecycle_management_opatchauto 12.2.0.1.14`