Description
FasterXML jackson-databind through 2.8.11 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 and CVE-2017-17485 deserialization flaws. This is exploitable via two different gadgets that bypass a blacklist.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | jackson-databind | 2.9.4-1 | — |
| Debian 13 | jackson-databind | 2.9.4-1 | — |
| Debian 12 | jackson-databind | 2.9.4-1 | — |
| Debian 9 | jackson-databind | 2.8.6-1+deb9u3 | DSA-4114-1 |
| Debian 8 | jackson-databind | 2.4.2-2+deb8u3 | DSA-4114-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | jackson-databind | 2.4.2-3ubuntu0.1~esm1 | — |
| Ubuntu Pro 14.04 LTS | jackson-databind | 2.2.2-1ubuntu0.1~esm1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | rhvm-appliance | 2:4.2-20180504.0.el7 | RHSA-2018:1525 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss EAP 7 | eap7-activemq-artemis +15 | 1.5.5.009-1.redhat_1.1.ep7.el6 | RHSA-2018:0480, RHSA-2018:0479 |
| Red Hat JBoss EAP 7 | eap7-apache-cxf +3 | 3.1.13-1.redhat_1.1.ep7.el6 | RHSA-2018:0480, RHSA-2018:0479 |
| Red Hat JBoss EAP 7 | eap7-glassfish-jsf | 2.2.13-6.SP5_redhat_1.1.ep7.el6 | RHSA-2018:0480, RHSA-2018:0479 |
| Red Hat JBoss EAP 7 | eap7-hibernate +5 | 5.1.12-1.Final_redhat_1.1.ep7.el6 | RHSA-2018:0480, RHSA-2018:0479 |
| Red Hat JBoss EAP 7 | eap7-infinispan +5 | 8.2.9-1.Final_redhat_1.1.ep7.el6 | RHSA-2018:0480, RHSA-2018:0479 |
| Red Hat JBoss EAP 7 | eap7-ironjacamar +8 | 1.4.7-1.Final_redhat_1.1.ep7.el6 | RHSA-2018:0480, RHSA-2018:0479 |
| Red Hat JBoss EAP 7 | eap7-jackson-core +9 | 2.8.11-1.redhat_1.1.ep7.el6 | RHSA-2018:0480, RHSA-2018:0479 |
| Red Hat JBoss EAP 7 | eap7-jboss-ec2-eap +1 | 7.1.1-3.1.GA_redhat_3.ep7.el6 | RHSA-2018:0481 |
| Red Hat JBoss EAP 7 | eap7-jboss-logmanager | 2.0.8-1.Final_redhat_1.1.ep7.el6 | RHSA-2018:0480, RHSA-2018:0479 |
| Red Hat JBoss EAP 7 | eap7-jboss-server-migration +18 | 1.0.3-6.Final_redhat_6.1.ep7.el6 | RHSA-2018:0480, RHSA-2018:0479 |
| Red Hat JBoss EAP 7 | eap7-jbossws-cxf | 5.1.10-1.Final_redhat_1.1.ep7.el6 | RHSA-2018:0480, RHSA-2018:0479 |
| Red Hat JBoss EAP 7 | eap7-narayana +10 | 5.5.31-1.Final_redhat_1.1.ep7.el6 | RHSA-2018:0480, RHSA-2018:0479 |
| Red Hat JBoss EAP 7 | eap7-picketlink-api +9 | 2.5.5-10.SP9_redhat_1.1.ep7.el6 | RHSA-2018:0480, RHSA-2018:0479 |
| Red Hat JBoss EAP 7 | eap7-resteasy +16 | 3.0.25-1.Final_redhat_1.1.ep7.el6 | RHSA-2018:0480, RHSA-2018:0479 |
| Red Hat JBoss EAP 7 | eap7-undertow | 1.4.18-4.SP2_redhat_1.1.ep7.el6 | RHSA-2018:0480, RHSA-2018:0479 |
| Red Hat JBoss EAP 7 | eap7-undertow-jastow | 2.0.3-1.Final_redhat_1.1.ep7.el6 | RHSA-2018:0480, RHSA-2018:0479 |
| Red Hat JBoss EAP 7 | eap7-wildfly +1 | 7.1.1-4.GA_redhat_2.1.ep7.el6 | RHSA-2018:0480, RHSA-2018:0479 |
| Red Hat JBoss EAP 7 | eap7-wildfly-elytron | 1.1.8-1.Final_redhat_1.1.ep7.el6 | RHSA-2018:0480, RHSA-2018:0479 |
| Red Hat JBoss EAP 7 | eap7-wildfly-http-client +4 | 1.0.9-1.Final_redhat_1.1.ep7.el6 | RHSA-2018:0480, RHSA-2018:0479 |
| Red Hat JBoss EAP 7 | eap7-wildfly-javadocs | 7.1.1-3.GA_redhat_2.1.ep7.el6 | RHSA-2018:0480, RHSA-2018:0479 |
| Red Hat JBoss EAP 7 | eap7-wss4j +6 | 2.1.11-1.redhat_1.1.ep7.el6 | RHSA-2018:0480, RHSA-2018:0479 |
| Red Hat JBoss EAP 7 | eap7-xml-security | 2.0.9-1.redhat_1.1.ep7.el6 | RHSA-2018:0480, RHSA-2018:0479 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | com.fasterxml.jackson.core:jackson-databind | >= 2.8.0, < 2.8.11.1 | 2.8.11.1 | GHSA-w3f4-3q6j-rh82 |
| Maven | com.fasterxml.jackson.core:jackson-databind | >= 2.9.0, < 2.9.4 | 2.9.4 | GHSA-w3f4-3q6j-rh82 |
| Maven | com.fasterxml.jackson.core:jackson-databind | < 2.7.9.5 | 2.7.9.5 | GHSA-w3f4-3q6j-rh82 |
Advisories 7
- WID-SEC-2026-2753 Red Hat JBoss Enterprise Application Platform: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
- RHSA-2018:1525 Red Hat Security Advisory: rhvm-appliance security and enhancement update Red Hat Security Advisories (RHSA) · Aug 9, 2026
- RHSA-2018:0481 Red Hat Security Advisory: jboss-ec2-eap package for EAP 7.1.1 Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2018:0479 Red Hat Security Advisory: JBoss Enterprise Application Platform 7.1.1 on RHEL 6 Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2018:0480 Red Hat Security Advisory: JBoss Enterprise Application Platform 7.1.1 for RHEL 7 Red Hat Security Advisories (RHSA) · Aug 5, 2026
- DSA-4114-1 jackson-databind - security update Debian Security (DSA / DLA) · Mar 9, 2026
- WID-SEC-2025-1459 Dell Data Protection Advisor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 3, 2025
References
- RHSA-2018:0479 vendor-advisory
- RHSA-2018:0481 vendor-advisory
- RHSA-2018:1525 vendor-advisory
- RHSA-2018:0480 vendor-advisory
- DSA-4114 vendor-advisory
- RHSA-2018:0478 vendor-advisory
- RHSA-2019:2858 vendor-advisory
- RHSA-2019:3149 vendor-advisory
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03902en_us
- https://security.netapp.com/advisory/ntap-20180423-0002/
- https://github.com/FasterXML/jackson-databind/issues/1899