Description
FasterXML jackson-databind through 2.8.11 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 and CVE-2017-17485 deserialization flaws. This is exploitable via two different gadgets that bypass a blacklist.
CVSS breakdown
CVSS 3.1
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected products
- Debian / debian_linux8.0 – 8.0
- Debian / debian_linux9.0 – 9.0
- FasterXML / jackson-databind2.0.0 – 2.6.7.3
- NetApp / e-series_santricity_os_controller11.0.0 – 11.60.3
- NetApp / e-series_santricity_web_services_proxy
- NetApp / oncommand_shift
- RedHat / jboss_enterprise_application_platform7.1 – 7.1
- RedHat / openshift_container_platform3.11 – 3.11
- RedHat / openshift_container_platform4.1 – 4.1
- RedHat / virtualization4.0 – 4.0
- RedHat / virtualization_host4.0 – 4.0
References
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2018:0479
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2018:0481
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2018:1525
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2018:0480
- VENDOR_ADVISORYhttps://www.debian.org/security/2018/dsa-4114
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2018:0478
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2019:2858
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2019:3149
- VENDOR_ADVISORYhttps://www.oracle.com/security-alerts/cpuoct2020.html
- MISChttps://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03902en_us
- MISChttps://security.netapp.com/advisory/ntap-20180423-0002/
- MISChttps://github.com/FasterXML/jackson-databind/issues/1899
Updated 21m ago · 8 sources