Red Hat Security Advisory: rh-maven35-jackson-databind security update

Fixed packages 2

Vulnerabilities 3

• Critical 9.8
  CVE-2017-15095

  jackson-databind vulnerable to deserialization flaw leading to unauthenticated remote code execution

  A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This i…

  FasterXML jackson-databind jackson-databind com.fasterxml.jackson.core:jackson-databind Debian Ubuntu Maven
  Feb 6, 2018
• Critical 9.8
  CVE-2017-17485 Public exploit EPSS 50%

  jackson-databind vulnerable to remote code execution due to incorrect deserialization and blocklist bypass

  FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readVa…

  com.fasterxml.jackson.core:jackson-databind jackson-databind jackson-databind Debian Ubuntu Maven
  Jan 10, 2018
• Critical 9.8
  CVE-2017-7525 Public exploit EPSS 38%

  jackson-databind is vulnerable to a deserialization flaw

  A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.

  FasterXML jackson-databind jackson-databind com.fasterxml.jackson.core:jackson-databind Debian Ubuntu Maven
  Feb 6, 2018

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1462702
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1506612
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1528565
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_0342.json
• report
  https://access.redhat.com/security/cve/CVE-2017-7525
• advisory
  https://www.cve.org/CVERecord?id=CVE-2017-7525
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2017-7525
• report
  https://access.redhat.com/security/cve/CVE-2017-15095
• advisory
  https://www.cve.org/CVERecord?id=CVE-2017-15095
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2017-15095
• article
  https://access.redhat.com/solutions/3442891
• report
  https://access.redhat.com/security/cve/CVE-2017-17485
• advisory
  https://www.cve.org/CVERecord?id=CVE-2017-17485
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2017-17485