Back to search
CVE-2017-17485
Published: Jan 10, 2018
Modified: Aug 27, 2025
PUBLISHED
Description
FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the Spring libraries are available in the classpath.
| Vendor | Product | Versions |
|---|---|---|
n/a | n/a | affected n/a |
References
RHSA-2018:1448
vendor-advisory
x_refsource_REDHAT
RHSA-2018:0479
vendor-advisory
x_refsource_REDHAT
RHSA-2018:0481
vendor-advisory
x_refsource_REDHAT
RHSA-2018:1449
vendor-advisory
x_refsource_REDHAT
RHSA-2018:1450
vendor-advisory
x_refsource_REDHAT
RHSA-2018:1451
vendor-advisory
x_refsource_REDHAT
RHSA-2018:0116
vendor-advisory
x_refsource_REDHAT
RHSA-2018:0342
vendor-advisory
x_refsource_REDHAT
20180109 CVE-2017-17485: one more way of rce in jackson-databind when defaultTyping+objects are used
mailing-list
x_refsource_BUGTRAQ
RHSA-2018:0480
vendor-advisory
x_refsource_REDHAT
RHSA-2018:1447
vendor-advisory
x_refsource_REDHAT
DSA-4114
vendor-advisory
x_refsource_DEBIAN
RHSA-2018:0478
vendor-advisory
x_refsource_REDHAT
RHSA-2018:2930
vendor-advisory
x_refsource_REDHAT
RHSA-2019:1782
vendor-advisory
x_refsource_REDHAT
RHSA-2019:1797
vendor-advisory
x_refsource_REDHAT
RHSA-2019:2858
vendor-advisory
x_refsource_REDHAT
RHSA-2019:3149
vendor-advisory
x_refsource_REDHAT
RHSA-2019:3892
vendor-advisory
x_refsource_REDHAT
https://www.oracle.com/security-alerts/cpuoct2020.html
x_refsource_MISC
https://security.netapp.com/advisory/ntap-20180201-0003/
x_refsource_CONFIRM
https://github.com/FasterXML/jackson-databind/issues/1855
x_refsource_CONFIRM
https://github.com/irsl/jackson-rce-via-spel/
x_refsource_MISC
Security Training
Train your team to recognize and prevent security threats with our comprehensive security awareness program.
Start TrainingVulnerability Scanning
Discover vulnerabilities in your applications and infrastructure before attackers do.
Scan Now