CVE-2017-15095

EPSS 8.36%
Veröffentlicht 06.02.2018 15:29:00
Zuletzt bearbeitet 21.11.2024 03:14:03
Erkennungen
Login

A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaw CVE-2017-7525 by blacklisting more classes that could be used maliciously.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 2 Referenzen 35

NVD 52 VulnDex Vulnerability Enrichment 0

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Fasterxml ≫ Jackson-databind Version >= 2.0.0 < 2.6.7.2

Fasterxml ≫ Jackson-databind Version >= 2.7.0 < 2.7.9.2

Fasterxml ≫ Jackson-databind Version >= 2.8.0 < 2.8.10

Fasterxml ≫ Jackson-databind Version 2.9.0 Update -

Fasterxml ≫ Jackson-databind Version 2.9.0 Update prerelease1

Fasterxml ≫ Jackson-databind Version 2.9.0 Update prerelease2

Fasterxml ≫ Jackson-databind Version 2.9.0 Update prerelease3

Fasterxml ≫ Jackson-databind Version 2.9.0 Update prerelease4

Debian ≫ Debian Linux Version 8.0

Debian ≫ Debian Linux Version 9.0

Redhat ≫ Openshift Container Platform Version 3.11

Redhat ≫ Satellite Version 6.4

Redhat ≫ Satellite Capsule Version 6.4

Redhat ≫ Openshift Container Platform Version 4.1

Redhat ≫ Enterprise Linux Version 7.0

Redhat ≫ Jboss Enterprise Application Platform Version 6.0.0

   Redhat ≫ Enterprise Linux Version 5.0
   Redhat ≫ Enterprise Linux Version 6.0
   Redhat ≫ Enterprise Linux Version 7.0

Redhat ≫ Jboss Enterprise Application Platform Version 6.4.0

   Redhat ≫ Enterprise Linux Version 5.0
   Redhat ≫ Enterprise Linux Version 6.0
   Redhat ≫ Enterprise Linux Version 7.0

Redhat ≫ Jboss Enterprise Application Platform Version 7.1.0

Redhat ≫ Enterprise Linux Version 6.0
Redhat ≫ Enterprise Linux Version 7.0

Netapp ≫ Oncommand Balance Version -

Netapp ≫ Oncommand Performance Manager Version - SwPlatform linux

Netapp ≫ Oncommand Performance Manager Version - SwPlatform vmware_vsphere

Netapp ≫ Oncommand Shift Version -

Netapp ≫ Snapcenter Version -

Oracle ≫ Banking Platform Version 2.5.0

Oracle ≫ Banking Platform Version 2.6.0

Oracle ≫ Banking Platform Version 2.6.1

Oracle ≫ Banking Platform Version 2.6.2

Oracle ≫ Clusterware Version 12.1.0.2.0

Oracle ≫ Communications Billing And Revenue Management Version 7.5

Oracle ≫ Communications Billing And Revenue Management Version 12.0

Oracle ≫ Communications Diameter Signaling Router Version < 8.3

Oracle ≫ Communications Instant Messaging Server Version 10.0.1.2.0

Oracle ≫ Database Server Version 12.2.0.1

Oracle ≫ Database Server Version 18.1

Oracle ≫ Enterprise Manager For Virtualization Version 13.2.2

Oracle ≫ Enterprise Manager For Virtualization Version 13.2.3

Oracle ≫ Enterprise Manager For Virtualization Version 13.3.1

Oracle ≫ Financial Services Analytical Applications Infrastructure Version 8.0.2

Oracle ≫ Financial Services Analytical Applications Infrastructure Version 8.0.3

Oracle ≫ Financial Services Analytical Applications Infrastructure Version 8.0.4

Oracle ≫ Financial Services Analytical Applications Infrastructure Version 8.0.5

Oracle ≫ Financial Services Analytical Applications Infrastructure Version 8.0.6

Oracle ≫ Financial Services Analytical Applications Infrastructure Version 8.0.7

Oracle ≫ Global Lifecycle Management Opatchauto Version < 12.2.0.1.14

Oracle ≫ Identity Manager Version 11.1.2.3.0

Oracle ≫ Identity Manager Version 12.2.1.3.0

Oracle ≫ Jd Edwards Enterpriseone Tools Version 9.2

Oracle ≫ Primavera Unifier Version >= 17.1 <= 17.12

Oracle ≫ Primavera Unifier Version 16.1

Oracle ≫ Primavera Unifier Version 16.2

Oracle ≫ Primavera Unifier Version 18.8

Oracle ≫ Utilities Advanced Spatial And Operational Analytics Version 2.7.0.1

Oracle ≫ Webcenter Portal Version 12.2.1.3.0

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	8.36%	0.943

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
NIST	9.8	3.9	5.9	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NIST	7.5	10	6.4	AV:N/AC:L/Au:N/C:P/I:P/A:P

CWE-184 Incomplete List of Disallowed Inputs

The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.

CWE-502 Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html

Patch

Third Party Advisory

http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html

Patch

Third Party Advisory

http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html

Patch

Third Party Advisory

https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html

Patch

Third Party Advisory

https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html

Patch

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:2927

Third Party Advisory

https://www.oracle.com/security-alerts/cpuoct2020.html

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:1447

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:1448

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:1449

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:1450

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:1451

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:0478

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:0479

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:0480

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:0481

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:0342

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:2858

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:3149

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:3892

Third Party Advisory

http://www.securityfocus.com/bid/103880

Third Party Advisory

VDB Entry

http://www.securitytracker.com/id/1039769

Third Party Advisory

VDB Entry

https://access.redhat.com/errata/RHSA-2017:3189

Third Party Advisory

https://access.redhat.com/errata/RHSA-2017:3190

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:0576

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:0577

Third Party Advisory

https://github.com/FasterXML/jackson-databind/issues/1680

Third Party Advisory

Issue Tracking

https://github.com/FasterXML/jackson-databind/issues/1737

Patch

Third Party Advisory

Issue Tracking

https://lists.apache.org/thread.html/f095a791bda6c0595f691eddd0febb2d396987eec5cbd29120d8c629%40%3Csolr-user.lucene.apache.org%3E

https://lists.debian.org/debian-lts-announce/2020/01/msg00037.html

Third Party Advisory

Mailing List

https://security.netapp.com/advisory/ntap-20171214-0003/

Third Party Advisory

https://www.debian.org/security/2017/dsa-4037

Third Party Advisory

https://nvd.nist.gov/vuln/detail/CVE-2017-15095

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2017-15095

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2017-15095

EUVD

Team-orientierte Vulnerability Management Plattform

Features der Plattform

CVE-2017-15095