CVE-2017-15095 — jackson-databind vulnerable to deserialization flaw leading to unauthenticated remote code execution

Description

A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaw CVE-2017-7525 by blacklisting more classes that could be used maliciously.

Affected products

Vendor	Product	Affected	Fixed
FasterXML	jackson-databind	before 2.8.10, before 2.9.1	—

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	jackson-databind	2.9.1-1	—
Debian 14	libjackson-json-java	1.9.13-2	—
Debian 13	jackson-databind	2.9.1-1	—
Debian 13	libjackson-json-java	1.9.13-2	—
Debian 12	jackson-databind	2.9.1-1	—
Debian 12	libjackson-json-java	1.9.13-2	—
Debian 9	jackson-databind	2.8.6-1+deb9u2	DSA-4037-1
Debian 9	libjackson-json-java	1.9.2-8+deb9u1	DLA-2342-1
Debian 8	jackson-databind	2.4.2-2+deb8u2	DSA-4037-1
Debian 8	libjackson-json-java	1.9.2-3+deb8u1	DLA-2091-1

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 20.04 LTS	libjackson-json-java	No fix yet	—
Ubuntu 18.04 LTS	libjackson-json-java	No fix yet	—
Ubuntu 16.04 LTS	libjackson-json-java	1.9.2-7ubuntu0.2	USN-4741-1

Show 2 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Ubuntu Pro 16.04 LTS	jackson-databind	2.4.2-3ubuntu0.1~esm1	—
Ubuntu Pro 14.04 LTS	jackson-databind	2.2.2-1ubuntu0.1~esm1	—
Ubuntu Pro 14.04 LTS	libjackson-json-java	1.9.2-3+deb8u1build0.14.04.1~esm1	—

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
RHEL 3	rh-eclipse46-jackson-databind +1	2.6.3-2.4.el7	RHSA-2017:3190
RHEL 3	rh-maven35-jackson-databind +1	2.7.6-2.4.el7	RHSA-2018:0342

Show 5 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Red Hat Satellite Capsule 6	SOAPpy	0.11.6-17.el7	RHSA-2018:2927
Red Hat Satellite Capsule 6	ansiblerole-insights-client	1.5-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	createrepo_c +1	0.7.4-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	foreman +1	1.18.0.37-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	foreman-bootloaders-redhat +1	201801241201-3.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	foreman-installer	1:1.18.0.2-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	foreman-proxy +1	1.18.0.1-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	gofer +2	2.12.1-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	hfsplus-tools	332.14-12.el7	RHSA-2018:2927
Red Hat Satellite Capsule 6	katello +3	3.7.0-8.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	katello-certs-tools	2.4.0-2.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	katello-client-bootstrap	1.6.0-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	katello-installer-base +1	3.7.0.10-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	katello-selinux	3.0.3-2.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	kobo	0.5.1-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	libstemmer	0-2.585svn.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	libwebsockets	2.1.0-3.el7	RHSA-2018:2927
Red Hat Satellite Capsule 6	livecd-tools +1	1:20.4-1.6.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	mod_passenger +3	4.0.18-24.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	mod_xsendfile	0.12-10.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	mongodb +1	2.6.11-2.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	ostree	2017.1-2.atomic.el7	RHSA-2018:2927
Red Hat Satellite Capsule 6	pulp +14	2.16.4.1-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	pulp-docker +3	3.1.4.1-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	pulp-katello	1.0.2-5.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	pulp-ostree +4	1.3.0-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	pulp-puppet +3	2.16.4-3.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	pulp-rpm +4	2.16.4.1-5.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	puppet-agent	5.5.0-2.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	puppet-agent-oauth	0.5.1-3.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	puppet-foreman_scap_client	0.3.16-3.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	puppetlabs-stdlib	4.2.1-1.20140510git08b00d9.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	puppetserver	5.3.1-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	python-amqp +1	2.2.2-3.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	python-anyjson	0.3.3-5.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	python-billiard +1	1:3.5.0.3-3.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	python-blinker	1.3-2.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	python-bson +2	3.2-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	python-celery +1	4.0.2-4.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	python-crane	3.1.1-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	python-django +1	1.11.11-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	python-flask	1:0.10.1-4.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	python-fpconst	0.7.3-12.el7	RHSA-2018:2927
Red Hat Satellite Capsule 6	python-gnupg	0.3.7-1.el7ui	RHSA-2018:2927
Red Hat Satellite Capsule 6	python-isodate	0.5.0-5.pulp.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	python-itsdangerous	0.23-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	python-jinja2	2.7.2-2.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	python-kid	0.9.6-11.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	python-kombu +1	1:4.0.2-8.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	python-mongoengine	0.10.5-2.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	python-nectar	1.5.6-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	python-oauth2	1.5.211-8.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	python-okaara	1.0.32-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	python-qpid	1.35.0-5.el7	RHSA-2018:2927
Red Hat Satellite Capsule 6	python-semantic_version	2.2.0-6.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	python-simplejson	3.2.0-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	python-twisted-core	12.2.0-4.el7	RHSA-2018:2927
Red Hat Satellite Capsule 6	python-twisted-web	12.1.0-5.el7_2	RHSA-2018:2927
Red Hat Satellite Capsule 6	python-vine +1	1.1.3-4.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	python-werkzeug	0.9.1-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	python-zope-interface	4.0.5-4.el7	RHSA-2018:2927
Red Hat Satellite Capsule 6	qpid-cpp +6	1.36.0-19.el7	RHSA-2018:2927
Red Hat Satellite Capsule 6	qpid-dispatch +2	0.8.0-19.el7	RHSA-2018:2927
Red Hat Satellite Capsule 6	qpid-proton +2	0.16.0-12.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	redhat-access-insights-puppet	0.0.9-3.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	repoview	0.6.6-4.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-ansi	1.4.3-3.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-bundler_ext +1	0.4.1-3.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-clamp +1	1.1.2-2.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-concurrent-ruby	1:1.0.3-6.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-fast_gettext	1.1.0-4.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-ffi	1.4.0-3.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-gssapi	1.1.2-4.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-hashie +1	2.0.5-5.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-highline +1	1.7.8-3.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-kafo	2.1.0-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-kafo_parsers	0.1.6-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-kafo_wizards	0.0.1-2.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-little-plugger +1	1.1.3-22.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-logging	2.2.2-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-mime-types	1.19-7.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-multi_json	1.12.2-2.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-netrc	0.7.7-9.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-newt	0.9.6-3.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-oauth +1	0.5.4-2.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-openscap	0.4.7-3.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-powerbar +1	1.0.17-2.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-rack	1:1.6.4-3.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-rack-protection	1.5.3-4.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-rake	0.9.2.2-41.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-rb-inotify	0.9.7-4.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-rest-client	1.6.7-7.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-rkerberos	0.1.3-5.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-rsec	0.4.2-2.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-rubyipmi	0.10.0-2.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-sinatra	1:1.4.7-3.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-smart_proxy_ansible	2.0.2-3.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-smart_proxy_dhcp_remote_isc	0.0.4-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-smart_proxy_discovery	1.0.4-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-smart_proxy_discovery_image	1.0.9-2.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-smart_proxy_dynflow +1	0.2.1-2.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-smart_proxy_openscap	0.6.11-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-smart_proxy_remote_execution_ssh	0.2.0-3.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	rubygem-tilt	1.3.7-2.git.0.3b416c9.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	saslwrapper +1	0.22-5.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	satellite +3	6.4.0-15.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	satellite-installer	6.4.0.7-2.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm +1	4.0-3.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-ror51 +1	1.1-2.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-ror51-rubygem-concurrent-ruby +1	1.0.5-4.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-ror51-rubygem-mime-types	3.1-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-ror51-rubygem-mime-types-data	3.2016.0521-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-ror51-rubygem-multi_json	1.12.2-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-ror51-rubygem-mustermann	1.0.1-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-ror51-rubygem-rack	2.0.3-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-ror51-rubygem-sinatra +1	2.0.0-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-ror51-rubygem-sqlite3	1.3.13-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-ror51-rubygem-tilt	2.0.8-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-rubygem-algebrick	0.7.3-5.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-rubygem-apipie-bindings	0.2.2-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-rubygem-apipie-params	0.0.5-4.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-rubygem-awesome_print	1.8.0-2.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-rubygem-concurrent-ruby-edge	1:0.2.4-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-rubygem-domain_name	0.5.20160310-3.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-rubygem-dynflow	1.0.5.1-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-rubygem-fast_gettext	1.4.1-2.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-rubygem-ffi	1.4.0-11.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-rubygem-foreman-tasks-core	0.2.5-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-rubygem-foreman_ansible_core	2.1.1-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-rubygem-foreman_remote_execution_core	1.1.3-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-rubygem-gssapi	1.2.0-4.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-rubygem-hammer_cli	0.13.1-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-rubygem-hammer_cli_foreman_bootdisk	0.1.3.3-3.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-rubygem-hammer_cli_foreman_docker	0.0.6-3.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-rubygem-hammer_cli_foreman_tasks	0.0.12-2.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-rubygem-http-cookie	1.0.2-4.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-rubygem-locale	2.0.9-12.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-rubygem-logging	2.2.2-4.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-rubygem-net-ssh	4.0.1-4.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-rubygem-net-ssh-krb	0.4.0-2.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-rubygem-netrc	0.11.0-2.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-rubygem-rest-client	2.0.1-2.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-rubygem-sequel	5.7.1-1.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-rubygem-unf	0.1.3-6.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-rubygem-unf_ext	0.0.6-8.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	tfm-rubygem-unicode	0.4.4.1-5.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	v8	1:3.14.5.10-19.el7sat	RHSA-2018:2927
Red Hat Satellite Capsule 6	yaml-cpp	0.5.1-7.el7sat	RHSA-2018:2927
Red Hat Satellite 6	SOAPpy	0.11.6-17.el7	RHSA-2018:2927
Red Hat Satellite 6	ansiblerole-insights-client	1.5-1.el7sat	RHSA-2018:2927
Red Hat Satellite 6	candlepin +1	2.4.8-1.el7	RHSA-2018:2927
Red Hat Satellite 6	createrepo_c +1	0.7.4-1.el7sat	RHSA-2018:2927
Red Hat Satellite 6	foreman +13	1.18.0.37-1.el7sat	RHSA-2018:2927
Red Hat Satellite 6	foreman-bootloaders-redhat +1	201801241201-3.el7sat	RHSA-2018:2927
Red Hat Satellite 6	foreman-installer	1:1.18.0.2-1.el7sat	RHSA-2018:2927
Red Hat Satellite 6	foreman-proxy +1	1.18.0.1-1.el7sat	RHSA-2018:2927
Red Hat Satellite 6	gofer +2	2.12.1-1.el7sat	RHSA-2018:2927
Red Hat Satellite 6	hfsplus-tools	332.14-12.el7	RHSA-2018:2927
Red Hat Satellite 6	katello +4	3.7.0-8.el7sat	RHSA-2018:2927
Red Hat Satellite 6	katello-certs-tools	2.4.0-2.el7sat	RHSA-2018:2927
Red Hat Satellite 6	katello-client-bootstrap	1.6.0-1.el7sat	RHSA-2018:2927
Red Hat Satellite 6	katello-installer-base +1	3.7.0.10-1.el7sat	RHSA-2018:2927
Red Hat Satellite 6	katello-selinux	3.0.3-2.el7sat	RHSA-2018:2927
Red Hat Satellite 6	kobo	0.5.1-1.el7sat	RHSA-2018:2927
Red Hat Satellite 6	libwebsockets	2.1.0-3.el7	RHSA-2018:2927
Red Hat Satellite 6	liquibase	3.1.0-1.el7	RHSA-2018:2927
Red Hat Satellite 6	livecd-tools +1	1:20.4-1.6.el7sat	RHSA-2018:2927
Red Hat Satellite 6	mod_passenger	4.0.18-24.el7sat	RHSA-2018:2927
Red Hat Satellite 6	mod_xsendfile	0.12-10.el7sat	RHSA-2018:2927
Red Hat Satellite 6	ostree	2017.1-2.atomic.el7	RHSA-2018:2927
Red Hat Satellite 6	pcp-mmvstatsd	0.4-1.el7sat	RHSA-2018:2927
Red Hat Satellite 6	pulp +10	2.16.4.1-1.el7sat	RHSA-2018:2927
Red Hat Satellite 6	pulp-docker +3	3.1.4.1-1.el7sat	RHSA-2018:2927
Red Hat Satellite 6	pulp-katello	1.0.2-5.el7sat	RHSA-2018:2927
Red Hat Satellite 6	pulp-ostree +3	1.3.0-1.el7sat	RHSA-2018:2927
Red Hat Satellite 6	pulp-puppet +4	2.16.4-3.el7sat	RHSA-2018:2927
Red Hat Satellite 6	pulp-rpm +4	2.16.4.1-5.el7sat	RHSA-2018:2927
Red Hat Satellite 6	puppet-agent	5.5.0-2.el7sat	RHSA-2018:2927
Red Hat Satellite 6	puppet-agent-oauth	0.5.1-3.el7sat	RHSA-2018:2927
Red Hat Satellite 6	puppet-foreman_scap_client	0.3.16-3.el7sat	RHSA-2018:2927
Red Hat Satellite 6	puppetlabs-stdlib	4.2.1-1.20140510git08b00d9.el7sat	RHSA-2018:2927
Red Hat Satellite 6	puppetserver	5.3.1-1.el7sat	RHSA-2018:2927
Red Hat Satellite 6	python-amqp +1	2.2.2-3.el7sat	RHSA-2018:2927
Red Hat Satellite 6	python-anyjson	0.3.3-5.el7sat	RHSA-2018:2927
Red Hat Satellite 6	python-billiard +1	1:3.5.0.3-3.el7sat	RHSA-2018:2927
Red Hat Satellite 6	python-blinker	1.3-2.el7sat	RHSA-2018:2927
Red Hat Satellite 6	python-bson +2	3.2-1.el7sat	RHSA-2018:2927
Red Hat Satellite 6	python-celery +1	4.0.2-4.el7sat	RHSA-2018:2927
Red Hat Satellite 6	python-crane	3.1.1-1.el7sat	RHSA-2018:2927
Red Hat Satellite 6	python-django +1	1.11.11-1.el7sat	RHSA-2018:2927
Red Hat Satellite 6	python-flask	1:0.10.1-4.el7sat	RHSA-2018:2927
Red Hat Satellite 6	python-fpconst	0.7.3-12.el7	RHSA-2018:2927
Red Hat Satellite 6	python-gnupg	0.3.7-1.el7ui	RHSA-2018:2927
Red Hat Satellite 6	python-isodate	0.5.0-5.pulp.el7sat	RHSA-2018:2927
Red Hat Satellite 6	python-itsdangerous	0.23-1.el7sat	RHSA-2018:2927
Red Hat Satellite 6	python-jinja2	2.7.2-2.el7sat	RHSA-2018:2927
Red Hat Satellite 6	python-kid	0.9.6-11.el7sat	RHSA-2018:2927
Red Hat Satellite 6	python-kombu +1	1:4.0.2-8.el7sat	RHSA-2018:2927
Red Hat Satellite 6	python-mongoengine	0.10.5-2.el7sat	RHSA-2018:2927
Red Hat Satellite 6	python-nectar	1.5.6-1.el7sat	RHSA-2018:2927
Red Hat Satellite 6	python-oauth2	1.5.211-8.el7sat	RHSA-2018:2927
Red Hat Satellite 6	python-okaara	1.0.32-1.el7sat	RHSA-2018:2927
Red Hat Satellite 6	python-qpid	1.35.0-5.el7	RHSA-2018:2927
Red Hat Satellite 6	python-saslwrapper	0.22-5.el7sat	RHSA-2018:2927
Red Hat Satellite 6	python-semantic_version	2.2.0-6.el7sat	RHSA-2018:2927
Red Hat Satellite 6	python-simplejson	3.2.0-1.el7sat	RHSA-2018:2927
Red Hat Satellite 6	python-twisted-core	12.2.0-4.el7	RHSA-2018:2927
Red Hat Satellite 6	python-twisted-web	12.1.0-5.el7_2	RHSA-2018:2927
Red Hat Satellite 6	python-vine +1	1.1.3-4.el7sat	RHSA-2018:2927
Red Hat Satellite 6	python-werkzeug	0.9.1-1.el7sat	RHSA-2018:2927
Red Hat Satellite 6	python-zope-interface	4.0.5-4.el7	RHSA-2018:2927
Red Hat Satellite 6	qpid-cpp +7	1.36.0-19.el7	RHSA-2018:2927
Red Hat Satellite 6	qpid-dispatch +2	0.8.0-19.el7	RHSA-2018:2927
Red Hat Satellite 6	qpid-proton +2	0.16.0-12.el7sat	RHSA-2018:2927
Red Hat Satellite 6	redhat-access-insights-puppet	0.0.9-3.el7sat	RHSA-2018:2927
Red Hat Satellite 6	repoview	0.6.6-4.el7sat	RHSA-2018:2927
Red Hat JBoss EAP 7	eap7-activemq-artemis +15	1.5.5.009-1.redhat_1.1.ep7.el6	RHSA-2018:0480, RHSA-2018:0479
Red Hat JBoss EAP 7	eap7-apache-cxf +3	3.1.13-1.redhat_1.1.ep7.el6	RHSA-2018:0480, RHSA-2018:0479
Red Hat JBoss EAP 7	eap7-glassfish-jsf	2.2.13-6.SP5_redhat_1.1.ep7.el6	RHSA-2018:0480, RHSA-2018:0479
Red Hat JBoss EAP 7	eap7-hibernate +5	5.1.12-1.Final_redhat_1.1.ep7.el6	RHSA-2018:0480, RHSA-2018:0479
Red Hat JBoss EAP 7	eap7-infinispan +5	8.2.9-1.Final_redhat_1.1.ep7.el6	RHSA-2018:0480, RHSA-2018:0479
Red Hat JBoss EAP 7	eap7-ironjacamar +8	1.4.7-1.Final_redhat_1.1.ep7.el6	RHSA-2018:0480, RHSA-2018:0479
Red Hat JBoss EAP 7	eap7-jackson-core +9	2.8.11-1.redhat_1.1.ep7.el6	RHSA-2018:0480, RHSA-2018:0479
Red Hat JBoss EAP 7	eap7-jboss-ec2-eap +1	7.1.1-3.1.GA_redhat_3.ep7.el6	RHSA-2018:0481
Red Hat JBoss EAP 7	eap7-jboss-logmanager	2.0.8-1.Final_redhat_1.1.ep7.el6	RHSA-2018:0480, RHSA-2018:0479
Red Hat JBoss EAP 7	eap7-jboss-server-migration +18	1.0.3-6.Final_redhat_6.1.ep7.el6	RHSA-2018:0480, RHSA-2018:0479
Red Hat JBoss EAP 7	eap7-jbossws-cxf	5.1.10-1.Final_redhat_1.1.ep7.el6	RHSA-2018:0480, RHSA-2018:0479
Red Hat JBoss EAP 7	eap7-narayana +10	5.5.31-1.Final_redhat_1.1.ep7.el6	RHSA-2018:0480, RHSA-2018:0479
Red Hat JBoss EAP 7	eap7-picketlink-api +9	2.5.5-10.SP9_redhat_1.1.ep7.el6	RHSA-2018:0480, RHSA-2018:0479
Red Hat JBoss EAP 7	eap7-resteasy +16	3.0.25-1.Final_redhat_1.1.ep7.el6	RHSA-2018:0480, RHSA-2018:0479
Red Hat JBoss EAP 7	eap7-undertow	1.4.18-4.SP2_redhat_1.1.ep7.el6	RHSA-2018:0480, RHSA-2018:0479
Red Hat JBoss EAP 7	eap7-undertow-jastow	2.0.3-1.Final_redhat_1.1.ep7.el6	RHSA-2018:0480, RHSA-2018:0479
Red Hat JBoss EAP 7	eap7-wildfly +1	7.1.1-4.GA_redhat_2.1.ep7.el6	RHSA-2018:0480, RHSA-2018:0479
Red Hat JBoss EAP 7	eap7-wildfly-elytron	1.1.8-1.Final_redhat_1.1.ep7.el6	RHSA-2018:0480, RHSA-2018:0479
Red Hat JBoss EAP 7	eap7-wildfly-http-client +4	1.0.9-1.Final_redhat_1.1.ep7.el6	RHSA-2018:0480, RHSA-2018:0479
Red Hat JBoss EAP 7	eap7-wildfly-javadocs	7.1.1-3.GA_redhat_2.1.ep7.el6	RHSA-2018:0480, RHSA-2018:0479
Red Hat JBoss EAP 7	eap7-wss4j +6	2.1.11-1.redhat_1.1.ep7.el6	RHSA-2018:0480, RHSA-2018:0479
Red Hat JBoss EAP 7	eap7-xml-security	2.0.9-1.redhat_1.1.ep7.el6	RHSA-2018:0480, RHSA-2018:0479
Red Hat JBoss EAP 6	codehaus-jackson +4	1.9.9-12.redhat_6.1.ep6.el5	RHSA-2018:1450, RHSA-2018:1449, RHSA-2018:1448
Red Hat JBoss EAP 6	hornetq	2.3.25-26.SP24_redhat_1.1.ep6.el5	RHSA-2018:1450, RHSA-2018:1449, RHSA-2018:1448
Red Hat JBoss EAP 6	jboss-as-ee +62	7.5.20-1.Final_redhat_1.1.ep6.el5	RHSA-2018:1450, RHSA-2018:1449, RHSA-2018:1448
Red Hat JBoss EAP 6	jboss-ec2-eap +1	7.5.20-1.Final_redhat_1.ep6.el6	RHSA-2018:1451
Red Hat JBoss EAP 6	jbossts	1:4.17.43-1.Final_redhat_1.1.ep6.el5	RHSA-2018:1450, RHSA-2018:1449, RHSA-2018:1448
Red Hat JBoss EAP 6	jbossweb	7.5.28-1.Final_redhat_1.1.ep6.el5	RHSA-2018:1450, RHSA-2018:1449, RHSA-2018:1448
Red Hat JBoss EAP 6	jgroups	1:3.2.18-1.Final_redhat_1.1.ep6.el5	RHSA-2018:1450, RHSA-2018:1449, RHSA-2018:1448
Red Hat JBoss EAP 6	lucene-solr	3.6.2-8.redhat_9.1.ep6.el5	RHSA-2018:1450, RHSA-2018:1449, RHSA-2018:1448
Red Hat JBoss EAP 6	picketbox	4.1.7-1.Final_redhat_1.1.ep6.el5	RHSA-2018:1450, RHSA-2018:1449, RHSA-2018:1448
Red Hat Devtools 2	rh-eclipse47-jackson-databind +1	2.7.6-3.3.el7	RHSA-2017:3189

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Maven	com.fasterxml.jackson.core:jackson-databind	>= 2.8.0, < 2.8.11	2.8.11	GHSA-h592-38cm-4ggp
Maven	com.fasterxml.jackson.core:jackson-databind	>= 2.9.0, < 2.9.4	2.9.4	GHSA-h592-38cm-4ggp
Maven	com.fasterxml.jackson.core:jackson-databind	>= 2.0.0, < 2.6.7.3	2.6.7.3	GHSA-h592-38cm-4ggp
Maven	com.fasterxml.jackson.core:jackson-databind	>= 2.7.0, < 2.7.9.2	2.7.9.2	GHSA-h592-38cm-4ggp

Advisories 18

WID-SEC-2026-2753 Red Hat JBoss Enterprise Application Platform: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
RHSA-2018:1451 Red Hat Security Advisory: eap6-jboss-ec2-eap security update Red Hat Security Advisories (RHSA) · Aug 9, 2026
RHSA-2018:1450 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.20 security update Red Hat Security Advisories (RHSA) · Aug 9, 2026
RHSA-2018:1448 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.20 security update Red Hat Security Advisories (RHSA) · Aug 9, 2026
RHSA-2018:1449 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.20 security update Red Hat Security Advisories (RHSA) · Aug 9, 2026
RHSA-2018:2927 Red Hat Security Advisory: Satellite 6.4 security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Aug 5, 2026
RHSA-2018:0481 Red Hat Security Advisory: jboss-ec2-eap package for EAP 7.1.1 Red Hat Security Advisories (RHSA) · Aug 5, 2026
RHSA-2018:0479 Red Hat Security Advisory: JBoss Enterprise Application Platform 7.1.1 on RHEL 6 Red Hat Security Advisories (RHSA) · Aug 5, 2026
RHSA-2018:0480 Red Hat Security Advisory: JBoss Enterprise Application Platform 7.1.1 for RHEL 7 Red Hat Security Advisories (RHSA) · Aug 5, 2026
RHSA-2018:0342 Red Hat Security Advisory: rh-maven35-jackson-databind security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
RHSA-2017:3189 Red Hat Security Advisory: rh-eclipse47-jackson-databind security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
RHSA-2017:3190 Red Hat Security Advisory: rh-eclipse46-jackson-databind security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
USN-4741-1 libjackson-json-java vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
DSA-4037-1 jackson-databind - security update Debian Security (DSA / DLA) · Mar 9, 2026
DLA-2342-1 libjackson-json-java - security update Debian Security (DSA / DLA) · Mar 9, 2026
DLA-2091-1 libjackson-json-java - security update Debian Security (DSA / DLA) · Mar 9, 2026
WID-SEC-2026-0180 Dell Data Protection Advisor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 20, 2026
WID-SEC-2022-1375 JFrog Artifactory: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 12, 2025

References

RHSA-2018:1448 vendor-advisory
103880 vdb-entry
RHSA-2018:0479 vendor-advisory
RHSA-2018:0481 vendor-advisory
RHSA-2018:1449 vendor-advisory
RHSA-2018:1450 vendor-advisory
RHSA-2018:0577 vendor-advisory
RHSA-2018:0576 vendor-advisory
RHSA-2017:3190 vendor-advisory
RHSA-2018:1451 vendor-advisory
RHSA-2017:3189 vendor-advisory
RHSA-2018:2927 vendor-advisory
1039769 vdb-entry
RHSA-2018:0342 vendor-advisory
RHSA-2018:0480 vendor-advisory
RHSA-2018:1447 vendor-advisory
RHSA-2018:0478 vendor-advisory
DSA-4037 vendor-advisory
RHSA-2019:2858 vendor-advisory
RHSA-2019:3149 vendor-advisory
RHSA-2019:3892 vendor-advisory
[lucene-solr-user] 20191219 Re: CVE-2017-7525 fix for Solr 7.7.x mailing-list
[debian-lts-announce] 20200131 [SECURITY] [DLA 2091-1] libjackson-json-java security update mailing-list
http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
https://www.oracle.com/security-alerts/cpuoct2020.html
https://security.netapp.com/advisory/ntap-20171214-0003/
https://github.com/FasterXML/jackson-databind/issues/1737
https://github.com/FasterXML/jackson-databind/issues/1680