|Description||A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaw CVE-2017-7525 by blacklisting more classes that could be used maliciously.|
|Source||CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)|
Vulnerable and fixed packages
The table below lists information on source packages.
|jackson-databind (PTS)||stretch (security), stretch||2.8.6-1+deb9u6||fixed|
|buster, buster (security)||2.9.8-3+deb10u1||fixed|
|bullseye, sid, buster||1.9.13-1||vulnerable|
The information below is based on the following data on fixed versions.
The Debian upload for stretch (2.8.6-1+deb9u1) and jessie (2.4.2-2+deb8u1)
misses the further sets of blacklists, in particular as well
which was already for CVE-2017-7525 but then the further tickets and patches
to block more dangerous types (at leas they are):
This CVE-2017-15095 should be considered to include everything in
NO_DESER_CLASS_NAMES as of: