What is CVE-2017-15095?

CVE-2017-15095 is a critical-severity vulnerability in Fasterxml Jackson-Databind, classified under Incomplete List of Disallowed Inputs. CVSS score: 9.8/10. Published 2018-02-06.

How severe is CVE-2017-15095?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Is CVE-2017-15095 known to be exploited?

25 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Deserialization in Fasterxml Jackson-Databind

CVE-2017-15095

A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaw CVE-2017-7525 by blacklisting more classes that could be used maliciously.

EPSS: 0.084 (94.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Fasterxml Jackson-databind — versions before 2.9.1, 2.9.0, before 2.8.10
Netapp Oncommand_balance
Netapp Oncommand_performance_manager
Netapp Oncommand_shift
Netapp Snapcenter
Oracle Banking_platform — versions 2.5.0, 2.6.0, 2.6.1
Oracle Clusterware — versions 12.1.0.2.0
Oracle Communications_billing_and_revenue_management — versions 7.5, 12.0
Oracle Communications_diameter_signaling_router
Oracle Communications_instant_messaging_server — versions 10.0.1.2.0

Weakness classification (CWE)

Public proof-of-concept exploits

References

secalert@redhat.com (x_refsource_REDHAT, vendor-advisory, Third Party Advisory)
secalert@redhat.com (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)
secalert@redhat.com (x_refsource_REDHAT, vendor-advisory, Third Party Advisory)
secalert@redhat.com (x_refsource_REDHAT, vendor-advisory, Third Party Advisory)
secalert@redhat.com (x_refsource_REDHAT, vendor-advisory, Third Party Advisory)
secalert@redhat.com (x_refsource_REDHAT, vendor-advisory, Third Party Advisory)
secalert@redhat.com (x_refsource_REDHAT, vendor-advisory, Third Party Advisory)
secalert@redhat.com (x_refsource_REDHAT, vendor-advisory, Third Party Advisory)
secalert@redhat.com (x_refsource_REDHAT, vendor-advisory, Third Party Advisory)
secalert@redhat.com (x_refsource_REDHAT, vendor-advisory, Third Party Advisory)

Frequently asked questions

What is CVE-2017-15095?: CVE-2017-15095 is a critical-severity vulnerability in Fasterxml Jackson-Databind, classified under Incomplete List of Disallowed Inputs. CVSS score: 9.8/10. Published 2018-02-06.
How severe is CVE-2017-15095?: Critical severity. CVSS v3 base score is 9.8 out of 10.
Is CVE-2017-15095 known to be exploited?: 25 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.