NVD - CVE-2017-7525

CVE-2017-7525 Detail

Description

A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.

Severity

CVSS 3.x Severity and Metrics:

NIST: NVD

Base Score: 9.8 CRITICAL

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD Analysts use publicly available information to associate vector strings and CVSS scores. We also display any CVSS information provided within the CVE List from the CNA.

Note: NVD Analysts have published a CVSS score for this CVE based on publicly available information at the time of analysis. The CNA has not provided a score within the CVE List.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

Hyperlink	Resource
http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html	Patch Third Party Advisory
http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html	Patch Third Party Advisory
http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html	Patch Third Party Advisory
http://www.securityfocus.com/bid/99623	Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1039744	Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1039947	Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1040360	Third Party Advisory VDB Entry
https://access.redhat.com/errata/RHSA-2017:1834	Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:1835	Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:1836	Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:1837	Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:1839	Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:1840	Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:2477	Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:2546	Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:2547	Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:2633	Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:2635	Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:2636	Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:2637	Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:2638	Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:3141	Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:3454	Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:3455	Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:3456	Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:3458	Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:0294	Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:0342	Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1449	Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1450	Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:0910	Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2858	Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3149	Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1462702	Issue Tracking Third Party Advisory
https://cwiki.apache.org/confluence/display/WW/S2-055	Third Party Advisory
https://github.com/FasterXML/jackson-databind/issues/1599	Issue Tracking Patch Third Party Advisory
https://github.com/FasterXML/jackson-databind/issues/1723	Issue Tracking Third Party Advisory
https://lists.apache.org/thread.html/3c87dc8bca99a2b3b4743713b33d1de05b1d6b761fdf316224e9c81f@%3Cdev.lucene.apache.org%3E	Mailing List Third Party Advisory
https://lists.apache.org/thread.html/4641ed8616ccc2c1fbddac2c3dc9900c96387bc226eaf0232d61909b@%3Ccommits.cassandra.apache.org%3E	Mailing List Third Party Advisory
https://lists.apache.org/thread.html/5008bcbd45ee65ce39e4220b6ac53d28a24d6bc67d5804e9773a7399@%3Csolr-user.lucene.apache.org%3E	Mailing List Third Party Advisory
https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451@%3Csolr-user.lucene.apache.org%3E	Mailing List Third Party Advisory
https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe@%3Ccommits.druid.apache.org%3E	Mailing List Third Party Advisory
https://lists.apache.org/thread.html/b1f33fe5ade396bb903fdcabe9f243f7692c7dfce5418d3743c2d346@%3Cdev.lucene.apache.org%3E	Mailing List Third Party Advisory
https://lists.apache.org/thread.html/c10a2bf0fdc3d25faf17bd191d6ec46b29a353fa9c97bebd7c4e5913@%3Cdev.lucene.apache.org%3E	Mailing List Third Party Advisory
https://lists.apache.org/thread.html/c2ed4c0126b43e324cf740012a0edd371fd36096fd777be7bfe7a2a6@%3Cdev.lucene.apache.org%3E	Mailing List Third Party Advisory
https://lists.apache.org/thread.html/c9d5ff20929e8a3c8794facf4c4b326a9c10618812eec356caa20b87@%3Csolr-user.lucene.apache.org%3E	Mailing List Third Party Advisory
https://lists.apache.org/thread.html/f095a791bda6c0595f691eddd0febb2d396987eec5cbd29120d8c629@%3Csolr-user.lucene.apache.org%3E	Mailing List Third Party Advisory
https://lists.apache.org/thread.html/f60afd3c7e9ebaaf70fad4a4beb75cf8740ac959017a31e7006c7486@%3Cdev.lucene.apache.org%3E	Mailing List Third Party Advisory
https://lists.apache.org/thread.html/r42ac3e39e6265db12d9fc6ae1cd4b5fea7aed9830dc6f6d58228fed7@%3Ccommits.cassandra.apache.org%3E	Mailing List Third Party Advisory
https://lists.apache.org/thread.html/r68acf97f4526ba59a33cc6e592261ea4f85d890f99e79c82d57dd589@%3Cissues.spark.apache.org%3E	Mailing List Third Party Advisory
https://lists.apache.org/thread.html/rf7f87810c38dc9abf9f93989f76008f504cbf7c1a355214640b2d04c@%3Ccommits.cassandra.apache.org%3E	Mailing List Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/01/msg00037.html	Mailing List Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/08/msg00039.html	Mailing List Third Party Advisory
https://security.netapp.com/advisory/ntap-20171214-0002/	Third Party Advisory
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03902en_us	Third Party Advisory
https://www.debian.org/security/2017/dsa-4004	Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2020.html	Third Party Advisory
https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html	Patch Third Party Advisory
https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html	Patch Third Party Advisory
https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html	Patch Third Party Advisory

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-502	Deserialization of Untrusted Data	NIST
CWE-184	Incomplete List of Disallowed Inputs	Red Hat, Inc.

Known Affected Software Configurations Switch to CPE 2.2

CPEs loading, please wait.

Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.

Change History

41 change records found show changes

Quick Info

CVE Dictionary Entry:
CVE-2017-7525
NVD Published Date:
02/06/2018
NVD Last Modified:
06/08/2023
Source:
Red Hat, Inc.

CVE-2017-7525 Detail

Description

Severity

References to Advisories, Solutions, and Tools

Weakness Enumeration

Known Affected Software Configurations Switch to CPE 2.2

CPEs loading, please wait.

Change History

Reanalysis by NIST 6/08/2023 1:57:47 PM

Modified Analysis by NIST 4/12/2022 12:17:48 PM

CVE Modified by Red Hat, Inc. 9/27/2021 2:15:08 PM

CVE Modified by Red Hat, Inc. 9/27/2021 1:15:07 PM

Modified Analysis by NIST 2/25/2021 4:57:00 PM

CVE Modified by Red Hat, Inc. 2/23/2021 3:15:11 PM

Modified Analysis by NIST 1/19/2021 10:54:17 AM

CVE Modified by Red Hat, Inc. 10/20/2020 6:15:21 PM

CPE Deprecation Remap by NIST 10/15/2020 9:28:17 AM

CVE Modified by Red Hat, Inc. 8/24/2020 8:15:10 AM

CVE Modified by Red Hat, Inc. 1/31/2020 7:15:10 PM

CVE Modified by Red Hat, Inc. 12/19/2019 2:15:13 PM

CVE Modified by Red Hat, Inc. 12/18/2019 3:15:15 PM

CVE Modified by Red Hat, Inc. 12/18/2019 11:15:12 AM

CVE Modified by Red Hat, Inc. 11/15/2019 9:15:13 PM

CVE Modified by Red Hat, Inc. 11/13/2019 2:15:11 AM

CVE Modified by Red Hat, Inc. 11/12/2019 3:15:10 PM

CVE Modified by Red Hat, Inc. 10/18/2019 6:15:13 PM

CVE Modified by Red Hat, Inc. 10/09/2019 7:29:42 PM

CVE Modified by Red Hat, Inc. 9/26/2019 11:15:11 PM

Reanalysis by NIST 8/30/2019 11:31:23 AM

Modified Analysis by NIST 8/21/2019 10:48:58 AM

CVE Modified by Red Hat, Inc. 7/23/2019 7:15:24 PM

CVE Modified by Red Hat, Inc. 4/30/2019 2:29:01 PM

CVE Modified by Red Hat, Inc. 4/23/2019 3:31:15 PM

CVE Modified by Red Hat, Inc. 4/08/2019 3:29:00 PM

CVE Modified by Red Hat, Inc. 3/25/2019 12:29:00 PM

CVE Modified by Red Hat, Inc. 1/16/2019 2:29:20 PM

CVE Modified by Red Hat, Inc. 10/16/2018 9:30:55 PM

CVE Modified by Red Hat, Inc. 9/27/2018 11:29:03 AM

CVE Modified by Red Hat, Inc. 9/27/2018 6:29:17 AM

Modified Analysis by NIST 9/11/2018 8:16:07 AM

CVE Modified by Red Hat, Inc. 7/18/2018 9:29:07 PM

CVE Modified by Red Hat, Inc. 5/16/2018 9:29:11 PM

CVE Modified by Red Hat, Inc. 4/19/2018 9:29:20 PM

Initial Analysis by NIST 2/27/2018 2:33:11 PM

CVE Modified by Red Hat, Inc. 2/23/2018 9:29:05 PM

CVE Modified by Red Hat, Inc. 2/13/2018 9:29:02 PM

CVE Modified by Red Hat, Inc. 2/08/2018 9:29:02 PM

CVE Modified by Red Hat, Inc. 2/07/2018 9:29:04 PM

CVE Modified by Red Hat, Inc. 2/06/2018 9:29:00 PM

Quick Info