PT-2018-5762 · Debian+7 · Debian+26

Published 2017-11-16 · Updated 2023-09-13 · CVE-2017-15095

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: jackson-databind versions prior to 2.8.11 and 2.9.4 debian linux (affected versions not specified) fasterxml jackson-databind (affected versions not specified) netapp oncommand balance (affected versions not specified) netapp oncommand performance manager (affected versions not specified) netapp oncommand shift (affected versions not specified) netapp snapcenter (affected versions not specified) oracle banking platform (affected versions not specified) oracle clusterware (affected versions not specified) oracle communications billing and revenue management (affected versions not specified) oracle communications diameter signaling router (affected versions not specified) oracle communications instant messaging server (affected versions not specified) oracle database server (affected versions not specified) oracle enterprise manager for virtualization (affected versions not specified) oracle financial services analytical applications infrastructure (affected versions not specified) oracle global lifecycle management opatchauto (affected versions not specified) oracle identity manager (affected versions not specified) oracle jd edwards enterpriseone tools (affected versions not specified) oracle primavera unifier (affected versions not specified) oracle utilities advanced spatial and operational analytics (affected versions not specified) oracle webcenter portal (affected versions not specified) redhat jboss enterprise application platform (affected versions not specified) redhat openshift container platform (affected versions not specified) redhat satellite (affected versions not specified) redhat satellite capsule (affected versions not specified)

Description: A deserialization flaw was discovered in the jackson-databind, which could allow an unauthenticated user to perform code execution by sending maliciously crafted input to the readValue method of the ObjectMapper. This issue extends a previous flaw by blacklisting more classes that could be used maliciously.

Recommendations: For jackson-databind versions prior to 2.8.11 and 2.9.4, update to version 2.8.11 or 2.9.4 or later. For other affected products, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Deserialization of Untrusted Data

Incomplete List of Disallowed Inputs

Weakness Enumeration

CWE-502

CWE-184

Related Identifiers

ALT-PU-2018-1722

CVE-2017-15095

DLA-2091-1

DLA-2342-1

DSA-4037-1

GHSA-H592-38CM-4GGP

MGASA-2017-0408

RHSA-2017:3189

RHSA-2017:3190

RHSA-2018:0342

RHSA-2018:0479

RHSA-2018:0480

RHSA-2018:0481

RHSA-2018:1448

RHSA-2018:1449

RHSA-2018:1450

RHSA-2018:1451

RHSA-2018:2927

USN-4741-1

Affected Products

Alt Linux

Astra Linux

Debian

Netapp Oncommand Balance

Netapp Oncommand Performance Manager

Netapp Oncommand Shift

Netapp Snapcenter

Oracle Banking Platform

Oracle Clusterware

Oracle Communications Billing/Revenue Management

Oracle Communications Diameter Signaling Router

Communications Instant Messaging Server

Oracle Database Server

Oracle Enterprise Manager For Virtualization

Oracle Financial Services Analytical Applications Infrastructure

Oracle Global Lifecycle Management Opatchauto

Oracle Identity Manager

Oracle Jd Edwards Enterpriseone Tools

Oracle Primavera Unifier

Oracle Utilities Advanced Spatial/Operational Analytics

Oracle Webcenter Portal

Red Hat Jboss Enterprise Application Platform

Red Hat Openshift Container Platform

Red Hat Satellite

Red Hat Satellite Capsule

Ubuntu

Jackson-Databind

References · 90

• 🔥 https://github.com/SecureSkyTechnology/study-struts2-s2-054_055-jackson-cve-2017-7525_cve-2017-15095 · Exploit
• 🔥 https://github.com/jas502n/CVE-2019-12384 · Exploit
• 🔥 https://github.com/jas502n/CVE-2020-8840 · Exploit
• 🔥 https://github.com/jas502n/jackson-CVE-2020-8840 · Exploit
• 🔥 https://github.com/fairyming/CVE-2020-8840 · Exploit
• 🔥 https://github.com/fairyming/CVE-2020-9548 · Exploit
• 🔥 https://github.com/LeadroyaL/cve-2019-14540-exploit · Exploit
• 🔥 https://github.com/fairyming/CVE-2020-9547 · Exploit
• 🔥 https://github.com/MagicZer0/Jackson_RCE-CVE-2019-12384 · Exploit
• 🔥 https://github.com/JavanXD/Demo-Exploit-Jackson-RCE · Exploit
• 🔥 https://github.com/Al1ex/CVE-2019-12814 · Exploit
• 🔥 https://github.com/Veraxy00/CVE-2020-8840 · Exploit
• 🔥 https://github.com/Al1ex/CVE-2020-11113 · Exploit
• 🔥 https://github.com/Al1ex/CVE-2020-10673 · Exploit
• 🔥 https://github.com/Ingenuity-Fainting-Goats/CVE-2017-7525-Jackson-Deserialization-Lab · Exploit