High · published January 22, 2018
FasterXML jackson-databind through 2.8.11 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 and CVE-2017-17485 deserialization flaws. This is exploitable via two different gadgets that bypass a blacklist.
| Product | Versions | Fixed in |
|---|---|---|
| fasterxml/jackson-databind | ≥ 2.0.0, < 2.6.7.3 | 2.6.7.3 |
| fasterxml/jackson-databind | ≥ 2.7.0, < 2.7.9.2 | 2.7.9.2 |
| fasterxml/jackson-databind | ≥ 2.8.0, < 2.8.11.1 | 2.8.11.1 |
| fasterxml/jackson-databind | ≥ 2.9.0, < 2.9.4 | 2.9.4 |
| debian/debian_linux | all versions | — |
| debian/debian_linux | all versions | — |
| redhat/openshift_container_platform | all versions | — |
| redhat/virtualization | all versions | — |
| redhat/virtualization_host | all versions | — |
| redhat/jboss_enterprise_application_platform | all versions | — |
| redhat/openshift_container_platform | all versions | — |
| netapp/e-series_santricity_os_controller | ≥ 11.0.0, ≤ 11.60.3 | — |
| netapp/e-series_santricity_web_services_proxy | all versions | — |
| netapp/oncommand_shift | all versions | — |