logo
DATABASE RESOURCES PRICING ABOUT US

jackson-databind vulnerable to remote code execution due to incorrect deserialization and blocklist bypass

Description

FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the Spring libraries are available in the classpath.


Affected Software


CPE Name Name Version
com.fasterxml.jackson.core:jackson-databind 2.0.0
com.fasterxml.jackson.core:jackson-databind 2.0.0-RC1
com.fasterxml.jackson.core:jackson-databind 2.0.0-RC2
com.fasterxml.jackson.core:jackson-databind 2.0.0-RC3
com.fasterxml.jackson.core:jackson-databind 2.0.1
com.fasterxml.jackson.core:jackson-databind 2.0.2
com.fasterxml.jackson.core:jackson-databind 2.0.4
com.fasterxml.jackson.core:jackson-databind 2.0.5
com.fasterxml.jackson.core:jackson-databind 2.0.6
com.fasterxml.jackson.core:jackson-databind 2.1.0
com.fasterxml.jackson.core:jackson-databind 2.1.1
com.fasterxml.jackson.core:jackson-databind 2.1.2
com.fasterxml.jackson.core:jackson-databind 2.1.3
com.fasterxml.jackson.core:jackson-databind 2.1.4
com.fasterxml.jackson.core:jackson-databind 2.1.5
com.fasterxml.jackson.core:jackson-databind 2.2.0
com.fasterxml.jackson.core:jackson-databind 2.2.0-rc1
com.fasterxml.jackson.core:jackson-databind 2.2.1
com.fasterxml.jackson.core:jackson-databind 2.2.2
com.fasterxml.jackson.core:jackson-databind 2.2.3
com.fasterxml.jackson.core:jackson-databind 2.2.4
com.fasterxml.jackson.core:jackson-databind 2.3.0
com.fasterxml.jackson.core:jackson-databind 2.3.0-rc1
com.fasterxml.jackson.core:jackson-databind 2.3.1
com.fasterxml.jackson.core:jackson-databind 2.3.2
com.fasterxml.jackson.core:jackson-databind 2.3.3
com.fasterxml.jackson.core:jackson-databind 2.3.4
com.fasterxml.jackson.core:jackson-databind 2.3.5
com.fasterxml.jackson.core:jackson-databind 2.4.0
com.fasterxml.jackson.core:jackson-databind 2.4.0-rc1
com.fasterxml.jackson.core:jackson-databind 2.4.0-rc2
com.fasterxml.jackson.core:jackson-databind 2.4.0-rc3
com.fasterxml.jackson.core:jackson-databind 2.4.1
com.fasterxml.jackson.core:jackson-databind 2.4.1.1
com.fasterxml.jackson.core:jackson-databind 2.4.1.2
com.fasterxml.jackson.core:jackson-databind 2.4.1.3
com.fasterxml.jackson.core:jackson-databind 2.4.2
com.fasterxml.jackson.core:jackson-databind 2.4.3
com.fasterxml.jackson.core:jackson-databind 2.4.4
com.fasterxml.jackson.core:jackson-databind 2.4.5
com.fasterxml.jackson.core:jackson-databind 2.4.5.1
com.fasterxml.jackson.core:jackson-databind 2.4.6
com.fasterxml.jackson.core:jackson-databind 2.4.6.1
com.fasterxml.jackson.core:jackson-databind 2.5.0
com.fasterxml.jackson.core:jackson-databind 2.5.0-rc1
com.fasterxml.jackson.core:jackson-databind 2.5.1
com.fasterxml.jackson.core:jackson-databind 2.5.2
com.fasterxml.jackson.core:jackson-databind 2.5.3
com.fasterxml.jackson.core:jackson-databind 2.5.4
com.fasterxml.jackson.core:jackson-databind 2.5.5
com.fasterxml.jackson.core:jackson-databind 2.6.0
com.fasterxml.jackson.core:jackson-databind 2.6.0-rc1
com.fasterxml.jackson.core:jackson-databind 2.6.0-rc2
com.fasterxml.jackson.core:jackson-databind 2.6.0-rc3
com.fasterxml.jackson.core:jackson-databind 2.6.0-rc4
com.fasterxml.jackson.core:jackson-databind 2.6.1
com.fasterxml.jackson.core:jackson-databind 2.6.2
com.fasterxml.jackson.core:jackson-databind 2.6.3
com.fasterxml.jackson.core:jackson-databind 2.6.4
com.fasterxml.jackson.core:jackson-databind 2.6.5
com.fasterxml.jackson.core:jackson-databind 2.6.6
com.fasterxml.jackson.core:jackson-databind 2.6.7
com.fasterxml.jackson.core:jackson-databind 2.6.7.1
com.fasterxml.jackson.core:jackson-databind 2.6.7.2
com.fasterxml.jackson.core:jackson-databind 2.6.7.3
com.fasterxml.jackson.core:jackson-databind 2.6.7.4
com.fasterxml.jackson.core:jackson-databind 2.6.7.5
com.fasterxml.jackson.core:jackson-databind 2.7.0
com.fasterxml.jackson.core:jackson-databind 2.7.0-rc1
com.fasterxml.jackson.core:jackson-databind 2.7.0-rc2
com.fasterxml.jackson.core:jackson-databind 2.7.0-rc3
com.fasterxml.jackson.core:jackson-databind 2.7.1
com.fasterxml.jackson.core:jackson-databind 2.7.1-1
com.fasterxml.jackson.core:jackson-databind 2.7.2
com.fasterxml.jackson.core:jackson-databind 2.7.3
com.fasterxml.jackson.core:jackson-databind 2.7.4
com.fasterxml.jackson.core:jackson-databind 2.7.5
com.fasterxml.jackson.core:jackson-databind 2.7.6
com.fasterxml.jackson.core:jackson-databind 2.7.7
com.fasterxml.jackson.core:jackson-databind 2.7.8
com.fasterxml.jackson.core:jackson-databind 2.7.9
com.fasterxml.jackson.core:jackson-databind 2.7.9.1
com.fasterxml.jackson.core:jackson-databind 2.7.9.2
com.fasterxml.jackson.core:jackson-databind 2.7.9.3
com.fasterxml.jackson.core:jackson-databind 2.7.9.4
com.fasterxml.jackson.core:jackson-databind 2.7.9.5
com.fasterxml.jackson.core:jackson-databind 2.7.9.6
com.fasterxml.jackson.core:jackson-databind 2.7.9.7
com.fasterxml.jackson.core:jackson-databind 2.8.0
com.fasterxml.jackson.core:jackson-databind 2.8.0.rc1
com.fasterxml.jackson.core:jackson-databind 2.8.0.rc2
com.fasterxml.jackson.core:jackson-databind 2.8.1
com.fasterxml.jackson.core:jackson-databind 2.8.10
com.fasterxml.jackson.core:jackson-databind 2.8.2
com.fasterxml.jackson.core:jackson-databind 2.8.3
com.fasterxml.jackson.core:jackson-databind 2.8.4
com.fasterxml.jackson.core:jackson-databind 2.8.5
com.fasterxml.jackson.core:jackson-databind 2.8.6
com.fasterxml.jackson.core:jackson-databind 2.8.7
com.fasterxml.jackson.core:jackson-databind 2.8.8
com.fasterxml.jackson.core:jackson-databind 2.8.8.1
com.fasterxml.jackson.core:jackson-databind 2.8.9

Related