VYPR
Get started
← All advisories
Critical severityNVD Advisory· Published Feb 6, 2018· Updated Sep 16, 2024

CVE-2017-15095

CVE-2017-15095

Description

A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaw CVE-2017-7525 by blacklisting more classes that could be used maliciously.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
com.fasterxml.jackson.core:jackson-databindMaven
>= 2.8.0, < 2.8.112.8.11
com.fasterxml.jackson.core:jackson-databindMaven
>= 2.9.0, < 2.9.42.9.4
com.fasterxml.jackson.core:jackson-databindMaven
>= 2.0.0, < 2.6.7.32.6.7.3
com.fasterxml.jackson.core:jackson-databindMaven
>= 2.7.0, < 2.7.9.22.7.9.2

Affected products

1

Patches

6
a054585e2175
https://github.com/FasterXML/jackson-databindvia ghsa
commit
a3939d36edcc
https://github.com/FasterXML/jackson-databindvia ghsa
commit
ddfddfba6414
https://github.com/FasterXML/jackson-databindvia ghsa
commit
e865a7a4464d
https://github.com/FasterXML/jackson-databindvia ghsa
commit
e8f043d1aac9
https://github.com/FasterXML/jackson-databindvia ghsa
commit
80566a0f96b2
https://github.com/tolbertam/jackson-databindvia ghsa
commit

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

44

News mentions

0

No linked articles in our index yet.