CVE-2017-7525
Published: 6 February 2018
A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.
From the Ubuntu Security Team
It was discovered that Jackson Databind incorrectly handled deserialization. An attacker could possibly use this issue to execute arbitrary code.
Priority
Status
| Package | Release | Status |
|---|---|---|
|
jackson-databind Launchpad, Ubuntu, Debian |
artful |
Released
(2.8.6-1+deb9u1build0.17.10.1)
|
| bionic |
Not vulnerable
(2.9.1-1)
|
|
| cosmic |
Not vulnerable
(2.9.1-1)
|
|
| disco |
Not vulnerable
(2.9.1-1)
|
|
| eoan |
Not vulnerable
(2.9.1-1)
|
|
| focal |
Not vulnerable
(2.9.1-1)
|
|
| groovy |
Not vulnerable
(2.9.1-1)
|
|
| hirsute |
Not vulnerable
(2.9.1-1)
|
|
| impish |
Not vulnerable
(2.9.1-1)
|
|
| jammy |
Not vulnerable
(2.9.1-1)
|
|
| kinetic |
Not vulnerable
(2.9.1-1)
|
|
| lunar |
Not vulnerable
(2.9.1-1)
|
|
| mantic |
Not vulnerable
(2.9.1-1)
|
|
| trusty |
Released
(2.2.2-1ubuntu0.1~esm1)
Available with Ubuntu Pro or Ubuntu Pro (Infra-only) |
|
| upstream |
Released
(2.9.1-1)
|
|
| xenial |
Released
(2.4.2-3ubuntu0.1~esm1)
Available with Ubuntu Pro |
|
| yakkety |
Ignored
(end of life)
|
|
| zesty |
Released
(2.8.6-1+deb9u1build0.17.04.1)
|
|
|
libjackson-json-java Launchpad, Ubuntu, Debian |
bionic |
Needs triage
|
| focal |
Needs triage
|
|
| groovy |
Ignored
(end of life)
|
|
| hirsute |
Not vulnerable
(1.9.13-2)
|
|
| impish |
Not vulnerable
(1.9.13-2)
|
|
| jammy |
Not vulnerable
(1.9.13-2)
|
|
| kinetic |
Not vulnerable
(1.9.13-2)
|
|
| lunar |
Not vulnerable
(1.9.13-2)
|
|
| mantic |
Not vulnerable
(1.9.13-2)
|
|
| trusty |
Released
(1.9.2-3+deb8u1build0.14.04.1~esm1)
Available with Ubuntu Pro or Ubuntu Pro (Infra-only) |
|
| upstream |
Needs triage
|
|
| xenial |
Released
(1.9.2-7ubuntu0.2)
|
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score | 9.8 |
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality | High |
| Integrity impact | High |
| Availability impact | High |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |