CVE-2017-7525

CRITICALImmediate

Published:Feb 6, 2018(8 years ago)

Modified:Nov 21, 2024

Remote ExploitNo Auth RequiredNo InteractionLow Complexity

Vulnerability Description

A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.

Attack Characteristics

Network AccessLow ComplexityNo Auth NeededNo User Interaction

🤖

AI analysis not yet available

Plain-English explanation, risk summary, and remediation steps will appear here once AI analysis is complete.

No Fix Known

No patch has been released yet. Apply workarounds or mitigations where available.

Affected Software

Vendor	Product	Versions	Fixed In
redhat	jboss_enterprise_application_platform	-	-
redhat	jboss_enterprise_application_platform	-	-
redhat	jboss_enterprise_application_platform

Timeline

Published
CVE disclosed publicly
Feb 6, 20188 years ago
Last Modified
Most recent update
Nov 21, 20241 year ago
Indexed to CVEInsight
Added to this platform
Mar 29, 20261 month ago

References

120

http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067...Patch
http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247...Patch
http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296...Patch

CVSS Score

v3.1

9.8/ 10.0

CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

At a Glance

Affected Products

120

References

redhat / jboss_enterprise_application_platform

http://www.securityfocus.com/bid/99623Third Party Advisory

http://www.securitytracker.com/id/1039744Third Party Advisory

http://www.securitytracker.com/id/1039947Third Party Advisory

http://www.securitytracker.com/id/1040360Third Party Advisory

https://access.redhat.com/errata/RHSA-2017:1834Third Party Advisory

https://access.redhat.com/errata/RHSA-2017:1835Third Party Advisory

https://access.redhat.com/errata/RHSA-2017:1836Third Party Advisory

https://access.redhat.com/errata/RHSA-2017:1837Third Party Advisory

https://access.redhat.com/errata/RHSA-2017:1839Third Party Advisory

https://access.redhat.com/errata/RHSA-2017:1840Third Party Advisory

https://access.redhat.com/errata/RHSA-2017:2477Third Party Advisory

https://access.redhat.com/errata/RHSA-2017:2546Third Party Advisory

https://access.redhat.com/errata/RHSA-2017:2547Third Party Advisory

https://access.redhat.com/errata/RHSA-2017:2633Third Party Advisory

https://access.redhat.com/errata/RHSA-2017:2635Third Party Advisory

https://access.redhat.com/errata/RHSA-2017:2636Third Party Advisory

https://access.redhat.com/errata/RHSA-2017:2637Third Party Advisory

https://access.redhat.com/errata/RHSA-2017:2638Third Party Advisory

https://access.redhat.com/errata/RHSA-2017:3141Third Party Advisory

https://access.redhat.com/errata/RHSA-2017:3454Third Party Advisory

https://access.redhat.com/errata/RHSA-2017:3455Third Party Advisory

https://access.redhat.com/errata/RHSA-2017:3456Third Party Advisory

https://access.redhat.com/errata/RHSA-2017:3458Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:0294Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:0342Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:1449Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:1450Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:0910Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:2858Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:3149Third Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=1462702Issue Tracking

https://cwiki.apache.org/confluence/display/WW/S2-055Third Party Advisory

https://github.com/FasterXML/jackson-databind/issues/1599Issue Tracking

https://github.com/FasterXML/jackson-databind/issues/1723Issue Tracking

https://lists.apache.org/thread.html/3c87dc8bca99a2b3b4743713b33d1de05...

https://lists.apache.org/thread.html/4641ed8616ccc2c1fbddac2c3dc9900c9...

https://lists.apache.org/thread.html/5008bcbd45ee65ce39e4220b6ac53d28a...

https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411f...

https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8dae...

https://lists.apache.org/thread.html/b1f33fe5ade396bb903fdcabe9f243f76...

https://lists.apache.org/thread.html/c10a2bf0fdc3d25faf17bd191d6ec46b2...

https://lists.apache.org/thread.html/c2ed4c0126b43e324cf740012a0edd371...

https://lists.apache.org/thread.html/c9d5ff20929e8a3c8794facf4c4b326a9...

https://lists.apache.org/thread.html/f095a791bda6c0595f691eddd0febb2d3...

https://lists.apache.org/thread.html/f60afd3c7e9ebaaf70fad4a4beb75cf87...

https://lists.apache.org/thread.html/r42ac3e39e6265db12d9fc6ae1cd4b5fe...

https://lists.apache.org/thread.html/r68acf97f4526ba59a33cc6e592261ea4...

https://lists.apache.org/thread.html/rf7f87810c38dc9abf9f93989f76008f5...

https://lists.debian.org/debian-lts-announce/2020/01/msg00037.htmlMailing List

https://lists.debian.org/debian-lts-announce/2020/08/msg00039.htmlMailing List

https://security.netapp.com/advisory/ntap-20171214-0002/Third Party Advisory

https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=...Third Party Advisory

https://www.debian.org/security/2017/dsa-4004Third Party Advisory

https://www.oracle.com/security-alerts/cpuoct2020.htmlThird Party Advisory

https://www.oracle.com/technetwork/security-advisory/cpuapr2019-507281...Patch

https://www.oracle.com/technetwork/security-advisory/cpujan2019-507280...Patch

https://www.oracle.com/technetwork/security-advisory/cpujul2019-507283...Patch

http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067...Patch

http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247...Patch

http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296...Patch