Description
A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| FasterXML | jackson-databind | before 2.6.7.1, before 2.7.9.1, before 2.8.9 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | jackson-databind | 2.9.1-1 | — |
| Debian 14 | libjackson-json-java | 1.9.13-2 | — |
| Debian 13 | jackson-databind | 2.9.1-1 | — |
| Debian 13 | libjackson-json-java | 1.9.13-2 | — |
| Debian 12 | jackson-databind | 2.9.1-1 | — |
| Debian 12 | libjackson-json-java | 1.9.13-2 | — |
| Debian 9 | jackson-databind | 2.8.6-1+deb9u1 | DSA-4004-1 |
| Debian 9 | libjackson-json-java | 1.9.2-8+deb9u1 | DLA-2342-1 |
| Debian 8 | jackson-databind | 2.4.2-2+deb8u1 | DSA-4004-1 |
| Debian 8 | libjackson-json-java | 1.9.2-3+deb8u1 | DLA-2091-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | libjackson-json-java | No fix yet | — |
| Ubuntu 18.04 LTS | libjackson-json-java | No fix yet | — |
| Ubuntu 16.04 LTS | libjackson-json-java | 1.9.2-7ubuntu0.2 | USN-4741-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | jackson-databind | 2.4.2-3ubuntu0.1~esm1 | — |
| Ubuntu Pro 14.04 LTS | jackson-databind | 2.2.2-1ubuntu0.1~esm1 | — |
| Ubuntu Pro 14.04 LTS | libjackson-json-java | 1.9.2-3+deb8u1build0.14.04.1~esm1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | rhvm-appliance | 1:4.1.20171102.0-1.el7 | RHSA-2017:3141 |
| RHEL 3 | rh-maven35-jackson-databind +1 | 2.7.6-2.4.el7 | RHSA-2018:0342 |
| RHEL 2 | devtoolset-4-jackson-databind +1 | 2.5.0-2.4.el6 | RHSA-2017:1840 |
| RHEL 2 | rh-eclipse46-jackson-databind +1 | 2.6.3-2.3.el7 | RHSA-2017:1839 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss EAP 7 | eap7-activemq-artemis +14 | 1.1.0-18.SP21_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454, RHSA-2017:1835 |
| Red Hat JBoss EAP 7 | eap7-activemq-artemis-jdbc-store | 1.5.5.008-1.redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-antlr | 2.7.7-35.redhat_7.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-apache-commons-beanutils | 1.9.3-1.redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-apache-commons-cli | 1.3.1-1.redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-apache-commons-io | 2.5.0-2.redhat_2.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-apache-cxf +3 | 3.1.12-1.redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-apache-mime4j | 0.6.0-2.redhat_6.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-artemis-native +1 | 1.5.0-5.redhat_1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-artemis-wildfly-integration | 1.0.2-3.redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-azure-storage | 5.0.0-1.redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-bouncycastle +3 | 1.56.0-4.redhat_2.2.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-codehaus-jackson +4 | 1.9.13-7.redhat_4.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-commons-logging-jboss-logmanager | 1.0.2-2.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-cryptacular | 1.2.0-3.redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-cxf-xjc-dv +5 | 3.0.5-3.redhat_2.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-ecj | 4.6.1-1.redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-elytron-web +1 | 1.0.1-1.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-glassfish-concurrent | 1.0.0-3.redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-glassfish-el +1 | 3.0.1-2.b08_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-glassfish-jaf | 1.1.1-21.redhat_5.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-glassfish-javamail | 1.5.6-4.redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-glassfish-jsf | 2.2.12-2.SP4_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454, RHSA-2017:1835 |
| Red Hat JBoss EAP 7 | eap7-glassfish-json | 1.0.4-4.redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-guava +1 | 20.0.0-1.redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-h2database | 1.4.193-4.redhat_2.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-hibernate +5 | 5.0.14-1.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454, RHSA-2017:1835 |
| Red Hat JBoss EAP 7 | eap7-hibernate-commons-annotations | 5.0.1-3.Final_redhat_2.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-hibernate-jpa-2.1-api | 1.0.0-3.Final_redhat_2.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-hibernate-search +5 | 5.5.8-1.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-hibernate-validator +1 | 5.3.5-3.Final_redhat_2.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-httpcomponents-asyncclient | 4.1.2-1.redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-httpcomponents-client | 4.5.2-1.redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-httpcomponents-core | 4.4.4-2.redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-infinispan +5 | 8.2.8-1.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-ironjacamar +9 | 1.3.7-1.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454, RHSA-2017:1835 |
| Red Hat JBoss EAP 7 | eap7-jackson-core +8 | 2.8.9-1.redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-jackson-databind | 2.5.4-2.redhat_2.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454, RHSA-2017:1835 |
| Red Hat JBoss EAP 7 | eap7-jandex | 2.0.3-1.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-jansi | 1.16.0-5.redhat_4.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-java-classmate | 1.3.3-1.redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-javassist | 3.20.0-2.GA_redhat_3.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-jaxbintros | 1.0.2-19.GA_redhat_8.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-jaxen | 1.1.6-3.redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-jberet +1 | 1.2.4-3.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-jboss-aesh | 0.66.19-2.redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-jboss-annotations-api_1.2_spec | 1.0.0-2.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-jboss-classfilewriter | 1.2.1-2.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-jboss-concurrency-api_1.0_spec | 1.0.0-4.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-jboss-connector-api_1.7_spec | 1.0.0-5.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-jboss-dmr | 1.4.1-2.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-jboss-ec2-eap +1 | 7.0.7-1.GA_redhat_1.ep7.el6 | RHSA-2017:3458, RHSA-2017:1837 |
| Red Hat JBoss EAP 7 | eap7-jboss-ejb-api_3.2_spec +4 | 1.0.0-3.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-jboss-ejb-client | 4.0.9-1.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-jboss-ejb3-ext-api | 2.2.0-4.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-jboss-el-api_3.0_spec | 1.0.9-3.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-jboss-genericjms | 2.0.0-4.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-jboss-iiop-client +1 | 1.0.1-2.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-jboss-invocation | 1.5.0-5.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-jboss-jaxb-api_2.2_spec | 1.0.4-6.Final_redhat_4.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-jboss-jaxrpc-api_1.1_spec | 1.0.1-8.Final_redhat_5.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-jboss-jaxws-api_2.2_spec | 2.0.4-2.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-jboss-jms-api_2.0_spec | 1.0.1-4.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-jboss-jsf-api_2.2_spec | 2.2.13-4.redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-jboss-jsp-api_2.3_spec +2 | 1.0.1-3.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-jboss-logmanager | 2.0.7-3.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-jboss-metadata +5 | 10.0.2-3.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-jboss-modules | 1.5.4-1.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454, RHSA-2017:1835 |
| Red Hat JBoss EAP 7 | eap7-jboss-openjdk-orb | 8.0.8-2.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-jboss-remoting | 4.0.23-1.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454, RHSA-2017:1835 |
| Red Hat JBoss EAP 7 | eap7-jboss-remoting-jmx | 3.0.0-8.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-jboss-saaj-api_1.3_spec | 1.0.4-2.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-jboss-seam-int | 7.0.0-5.GA_redhat_2.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-jboss-security-xacml | 2.0.8-16.Final_redhat_8.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-jboss-server-migration +18 | 1.0.3-4.Final_redhat_4.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-jboss-transaction-spi | 7.6.0-1.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-jboss-vfs | 3.2.12-2.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-jboss-websocket-api_1.1_spec | 1.1.1-3.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-jboss-weld-2.2-api | 2.4.0-2.SP1_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-jboss-xnio-base | 3.4.6-1.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454, RHSA-2017:1835 |
| Red Hat JBoss EAP 7 | eap7-jbossws-common-tools | 1.2.4-1.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-jbossws-cxf | 5.1.9-2.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-jbossws-spi | 3.1.4-3.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-jettison | 1.3.8-1.redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-jgroups | 3.6.13-2.Final_redhat_2.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-jgroups-azure | 1.1.0-1.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-joda-time | 2.9.7-1.redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-jsoup | 1.8.3-3.redhat_2.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-jul-to-slf4j-stub | 1.0.1-6.Final_redhat_3.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-mustache-java +1 | 0.9.4-1.redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-narayana +10 | 5.5.30-2.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-neethi | 3.0.3-3.redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-netty +1 | 4.1.9-1.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-netty-xnio-transport | 0.1.2-1.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-objectweb-asm | 3.3.1-14.redhat_13.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-picketbox +1 | 5.0.2-2.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-picketbox-commons | 1.0.0-3.final_redhat_5.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-resteasy +17 | 3.0.19-6.SP4_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454, RHSA-2017:1835 |
| Red Hat JBoss EAP 7 | eap7-shibboleth-java-support | 7.1.1-3.redhat_2.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-slf4j +3 | 1.7.22-2.redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-snakeyaml | 1.17.0-1.redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-staxmapper | 1.3.0-1.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-sun-saaj-1.3-impl | 1.3.16-16.SP1_redhat_6.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-sun-ws-metadata-2.0-api | 1.0.0-6.MR1_redhat_8.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-taglibs-standard-impl +3 | 1.2.6-1.RC1_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-txw2 +7 | 2.2.11-10.redhat_4.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-undertow | 1.4.18-2.Final_redhat_2.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-undertow-jastow +2 | 2.0.2-1.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-vdx +2 | 1.1.6-1.redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-weld-core +3 | 2.4.3-1.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-wildfly +1 | 7.0.7-4.GA_redhat_3.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454, RHSA-2017:1835 |
| Red Hat JBoss EAP 7 | eap7-wildfly-client-config | 1.0.0-7.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-wildfly-common | 1.2.0-10.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-wildfly-discovery +1 | 1.0.0-9.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-wildfly-elytron | 1.1.7-1.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-wildfly-elytron-tool | 1.0.5-1.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-wildfly-http-client +4 | 1.0.8-1.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-wildfly-javadocs | 7.0.7-3.GA_redhat_4.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454, RHSA-2017:1835 |
| Red Hat JBoss EAP 7 | eap7-wildfly-naming-client | 1.0.7-1.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-wildfly-openssl +2 | 1.0.2-1.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-wildfly-openssl-linux | 1.0.2-13.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-wildfly-web-console-eap | 2.8.30-1.Final_redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454, RHSA-2017:1835 |
| Red Hat JBoss EAP 7 | eap7-woodstox-core | 5.0.3-1.redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-wss4j +6 | 2.1.10-1.redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-xml-security | 2.0.8-2.redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 7 | eap7-xom | 1.2.10-2.redhat_1.1.ep7.el6 | RHSA-2017:3455, RHSA-2017:3454 |
| Red Hat JBoss EAP 6 | apache-cxf | 2.7.18-7.SP6_redhat_1.1.ep6.el5 | RHSA-2017:2637, RHSA-2017:2636, RHSA-2017:2635 |
| Red Hat JBoss EAP 6 | codehaus-jackson +4 | 1.9.9-11.redhat_5.1.ep6.el5 | RHSA-2018:1450, RHSA-2018:1449, RHSA-2017:2637 |
| Red Hat JBoss EAP 6 | hibernate4-eap6 +4 | 4.2.27-1.Final_redhat_1.1.ep6.el5 | RHSA-2017:2637, RHSA-2017:2636, RHSA-2017:2635 |
| Red Hat JBoss EAP 6 | hornetq | 2.3.25-22.SP20_redhat_1.1.ep6.el5 | RHSA-2018:1450, RHSA-2018:1449, RHSA-2017:2637 |
| Red Hat JBoss EAP 6 | infinispan +4 | 5.2.22-1.Final_redhat_1.1.ep6.el5 | RHSA-2017:2637, RHSA-2017:2636, RHSA-2017:2635 |
| Red Hat JBoss EAP 6 | jboss-as-ee +60 | 7.5.17-2.Final_redhat_4.1.ep6.el5 | RHSA-2018:1450, RHSA-2018:1449, RHSA-2017:2637 |
| Red Hat JBoss EAP 6 | jboss-ec2-eap +1 | 7.5.17-1.Final_redhat_4.ep6.el6 | RHSA-2017:2638 |
| Red Hat JBoss EAP 6 | jboss-marshalling | 1.4.10-3.SP3_redhat_1.1.ep6.el5 | RHSA-2017:2637, RHSA-2017:2636, RHSA-2017:2635 |
| Red Hat JBoss EAP 6 | jboss-metadata +5 | 7.2.3-1.Final_redhat_1.1.ep6.el5 | RHSA-2017:2637, RHSA-2017:2636, RHSA-2017:2635 |
| Red Hat JBoss EAP 6 | jboss-modules | 1.3.10-1.Final_redhat_1.1.ep6.el5 | RHSA-2017:2637, RHSA-2017:2636, RHSA-2017:2635 |
| Red Hat JBoss EAP 6 | jboss-remoting3 | 3.3.10-1.Final_redhat_1.1.ep6.el5 | RHSA-2017:2637, RHSA-2017:2636, RHSA-2017:2635 |
| Red Hat JBoss EAP 6 | jboss-vfs2 | 3.2.12-1.Final_redhat_1.1.ep6.el5 | RHSA-2017:2637, RHSA-2017:2636, RHSA-2017:2635 |
| Red Hat JBoss EAP 6 | jbossas-javadocs | 7.5.17-4.Final_redhat_4.1.ep6.el5 | RHSA-2018:1450, RHSA-2018:1449, RHSA-2017:2637 |
| Red Hat JBoss EAP 6 | jbossas-modules-eap | 7.5.17-1.Final_redhat_4.1.ep6.el5 | RHSA-2018:1450, RHSA-2018:1449, RHSA-2017:2637 |
| Red Hat JBoss EAP 6 | jbossts | 1:4.17.43-1.Final_redhat_1.1.ep6.el5 | RHSA-2018:1450, RHSA-2018:1449 |
| Red Hat JBoss EAP 6 | jbossweb | 7.5.24-1.Final_redhat_1.1.ep6.el5 | RHSA-2018:1450, RHSA-2018:1449, RHSA-2017:2637 |
| Red Hat JBoss EAP 6 | jgroups | 1:3.2.18-1.Final_redhat_1.1.ep6.el5 | RHSA-2018:1450, RHSA-2018:1449 |
| Red Hat JBoss EAP 6 | log4j-eap6 | 1.2.16-12.redhat_3.1.ep6.el5 | RHSA-2017:2637, RHSA-2017:2636, RHSA-2017:2635 |
| Red Hat JBoss EAP 6 | log4j-jboss-logmanager | 1.1.4-1.Final_redhat_1.1.ep6.el5 | RHSA-2017:2637, RHSA-2017:2636, RHSA-2017:2635 |
| Red Hat JBoss EAP 6 | lucene-solr | 3.6.2-8.redhat_9.1.ep6.el5 | RHSA-2018:1450, RHSA-2018:1449 |
| Red Hat JBoss EAP 6 | picketbox | 4.1.7-1.Final_redhat_1.1.ep6.el5 | RHSA-2018:1450, RHSA-2018:1449 |
| Red Hat JBoss EAP 6 | picketlink-bindings +1 | 2.5.4-17.SP15_redhat_1.1.ep6.el5 | RHSA-2017:2637, RHSA-2017:2636, RHSA-2017:2635 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
GitHub 5 repositories
-
SecureSkyTechnology/study-struts2-s2-054_055-jackson-cve-2017-7525_cve-2017-15095 ★ 106 · Dec 4, 2017
Struts2の脆弱性S2-045, S2-055 および Jackson の脆弱性 CVE-2017-7525, CVE-2017-15095 の調査報告
-
JavanXD/Demo-Exploit-Jackson-RCE ★ 18 · Jan 22, 2019
Exploiting CVE-2017-7525 demo project with Angular7 frontend and Spring.
-
Ingenuity-Fainting-Goats/CVE-2017-7525-Jackson-Deserialization-Lab ★ 6 · Apr 22, 2020
Insecure Java Deserialization Lab
-
Dannners/jackson-deserialization-2017-7525 ★ 1 · Mar 2, 2020
Jackson Deserialization CVE-2017-7525 PoC
-
Nazicc/S2-055 ★ 0 · Dec 19, 2017
CVE-2017-7525 S2-055 Exploit
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | com.fasterxml.jackson.core:jackson-databind | < 2.6.7.1 | 2.6.7.1 | GHSA-qxxx-2pp7-5hmx |
| Maven | com.fasterxml.jackson.core:jackson-databind | >= 2.7.0, < 2.7.9.1 | 2.7.9.1 | GHSA-qxxx-2pp7-5hmx |
| Maven | com.fasterxml.jackson.core:jackson-databind | >= 2.8.0, < 2.8.9 | 2.8.9 | GHSA-qxxx-2pp7-5hmx |
Advisories 24
- WID-SEC-2026-2752 Red Hat JBoss Enterprise Application Platform: Mehrere Schwachstellen ermöglichen Ausführen von beliebigem Programmcode mit den Rechten des Dienstes BSI CERT-Bund (WID) · Aug 11, 2026
- RHSA-2018:1450 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.20 security update Red Hat Security Advisories (RHSA) · Aug 9, 2026
- RHSA-2018:1449 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.20 security update Red Hat Security Advisories (RHSA) · Aug 9, 2026
- RHSA-2017:2638 Red Hat Security Advisory: jboss-ec2-eap security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Aug 9, 2026
- RHSA-2017:3458 Red Hat Security Advisory: eap7-jboss-ec2-eap security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2017:3455 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1.0 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2017:3454 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1.0 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2017:3141 Red Hat Security Advisory: rhvm-appliance security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2017:2637 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.17 update on RHEL 5 Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2017:2636 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.17 update on RHEL 7 Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2017:2635 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.17 update on RHEL 6 Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2018:0342 Red Hat Security Advisory: rh-maven35-jackson-databind security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2017:1839 Red Hat Security Advisory: rh-eclipse46-jackson-databind security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2017:1840 Red Hat Security Advisory: devtoolset-4-jackson-databind security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2017:1837 Red Hat Security Advisory: eap7-jboss-ec2-eap security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2017:1835 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.0.7 on RHEL 7 Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2017:1834 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.0.7 on RHEL 6 Red Hat Security Advisories (RHSA) · Jun 29, 2026
- USN-4741-1 libjackson-json-java vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
- DLA-2342-1 libjackson-json-java - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-4004-1 jackson-databind - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-2091-1 libjackson-json-java - security update Debian Security (DSA / DLA) · Mar 9, 2026
- WID-SEC-2026-0180 Dell Data Protection Advisor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 20, 2026
- WID-SEC-2022-1375 JFrog Artifactory: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 12, 2025
- WID-SEC-2025-1212 Oracle Communications Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 2, 2025
References
- 1040360 vdb-entry
- RHSA-2017:1840 vendor-advisory
- RHSA-2017:2547 vendor-advisory
- RHSA-2017:1836 vendor-advisory
- RHSA-2017:1835 vendor-advisory
- RHSA-2018:1449 vendor-advisory
- 1039744 vdb-entry
- 1039947 vdb-entry
- RHSA-2017:2635 vendor-advisory
- RHSA-2017:2638 vendor-advisory
- RHSA-2018:1450 vendor-advisory
- RHSA-2017:3458 vendor-advisory
- RHSA-2018:0294 vendor-advisory
- RHSA-2017:1837 vendor-advisory
- RHSA-2017:1834 vendor-advisory
- RHSA-2017:2546 vendor-advisory
- RHSA-2017:2636 vendor-advisory
- RHSA-2017:3455 vendor-advisory
- RHSA-2017:2477 vendor-advisory
- RHSA-2017:3456 vendor-advisory
- RHSA-2018:0342 vendor-advisory
- RHSA-2017:1839 vendor-advisory
- 99623 vdb-entry
- RHSA-2017:2637 vendor-advisory
- RHSA-2017:3454 vendor-advisory
- DSA-4004 vendor-advisory
- RHSA-2017:3141 vendor-advisory
- RHSA-2017:2633 vendor-advisory
- [lucene-solr-user] 20190104 Re: SOLR v7 Security Issues Caused Denial of Use - Sonatype Application Composition Report mailing-list
- [lucene-dev] 20190325 [jira] [Closed] (SOLR-13110) CVE-2017-7525 Threat Level 9 Against Solr v7.6. org.codehaus.jackson : jackson-mapper-asl : 1.9.13. .A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 an mailing-list
- [lucene-dev] 20190325 [jira] [Updated] (SOLR-13110) CVE-2017-7525 Threat Level 9 Against Solr v7.6. org.codehaus.jackson : jackson-mapper-asl : 1.9.13. .A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 a mailing-list
- [lucene-dev] 20190325 [jira] [Assigned] (SOLR-13110) CVE-2017-7525 Threat Level 9 Against Solr v7.6. org.codehaus.jackson : jackson-mapper-asl : 1.9.13. .A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 mailing-list
- [lucene-dev] 20190325 [jira] [Resolved] (SOLR-13110) CVE-2017-7525 Threat Level 9 Against Solr v7.6. org.codehaus.jackson : jackson-mapper-asl : 1.9.13. .A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 mailing-list
- [lucene-dev] 20190325 [jira] [Updated] (SOLR-13110) CVE-2017-7525 Threat Level 9 Against Solr v7.6. org.codehaus.jackson : jackson-mapper-asl : 1.9.13. .A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 a mailing-list
- RHSA-2019:0910 vendor-advisory
- RHSA-2019:2858 vendor-advisory
- RHSA-2019:3149 vendor-advisory
- [cassandra-commits] 20191113 [jira] [Created] (CASSANDRA-15416) CVE-2017-7525 ( jackson-databind is vulnerable to Remote Code Execution) on version 3.11.4 mailing-list
- [druid-commits] 20191115 [GitHub] [incubator-druid] ccaominh opened a new pull request #8878: Address security vulnerabilities mailing-list
- [lucene-solr-user] 20191218 CVE-2017-7525 fix for Solr 7.7.x mailing-list
- [lucene-solr-user] 20191218 Re: CVE-2017-7525 fix for Solr 7.7.x mailing-list
- [lucene-solr-user] 20191219 Re: CVE-2017-7525 fix for Solr 7.7.x mailing-list
- [debian-lts-announce] 20200131 [SECURITY] [DLA 2091-1] libjackson-json-java security update mailing-list
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
- http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
- https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
- [debian-lts-announce] 20200824 [SECURITY] [DLA 2342-1] libjackson-json-java security update mailing-list
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03902en_us
- https://github.com/FasterXML/jackson-databind/issues/1723
- https://github.com/FasterXML/jackson-databind/issues/1599
- https://bugzilla.redhat.com/show_bug.cgi?id=1462702
- https://security.netapp.com/advisory/ntap-20171214-0002/
- https://cwiki.apache.org/confluence/display/WW/S2-055
- [spark-issues] 20210223 [jira] [Created] (SPARK-34511) Current Security vulnerabilities in spark libraries mailing-list
- [cassandra-commits] 20210927 [jira] [Commented] (CASSANDRA-15416) CVE-2017-7525 ( jackson-databind is vulnerable to Remote Code Execution) on version 3.11.4 mailing-list
- [cassandra-commits] 20210927 [jira] [Updated] (CASSANDRA-15416) CVE-2017-7525 ( jackson-databind is vulnerable to Remote Code Execution) on version 3.11.4 mailing-list