Critical Deserialization Vulnerability in jackson-databind: CVE-2017-15095
Summary
CVE-2017-15095: A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readV... Affects jackson-databind across 2 version ranges.
< 2.9.1-1
>= e8df0987e3034d102ee6d704d30a05a2e3ac7089, < fab5c3877f7b8ae28a8e3a14d805bc9dcc8c153d
Fixed in 2.9.1-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Jackson-databind is a widely used library in Java for converting Java objects to JSON and vice versa. It is a core component of the Jackson suite, which provides powerful data-binding capabilities. This library is integral for applications that require JSON processing, making it a critical dependency in many Java projects. The vulnerability in question exposes applications using vulnerable versions of jackson-databind to potential remote code execution attacks, particularly when handling untrusted input.
Vulnerability Detail
CVE-2017-15095 is a deserialization flaw found in jackson-databind versions prior to 2.8.10 and 2.9.1. This vulnerability allows an unauthenticated user to execute arbitrary code by sending specially crafted input to the readValue method of the ObjectMapper class. The flaw extends the previous vulnerability CVE-2017-7525 by adding more classes to a blacklist, which could be exploited maliciously. The severity of this vulnerability is underscored by its CVSS score of 9.8, indicating a high risk of exploitation.
How To Fix
Minimum fixed version
2.9.1-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade jackson-databindTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing input validation to sanitize and restrict the types of data being deserialized. This can help mitigate the risk of exploitation until a proper upgrade can be performed.
Conclusion
CVE-2017-15095 represents a significant security risk for applications using vulnerable versions of jackson-databind. It is crucial to upgrade to the recommended versions to protect against potential remote code execution attacks. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for jackson-databind →
FAQ
CVE-2017-15095 is a critical deserialization vulnerability in the jackson-databind library that can lead to remote code execution.
Versions of jackson-databind prior to 2.8.10 and 2.9.1 are vulnerable to this issue.
You can use Vulert, which monitors open-source vulnerabilities in your software by analyzing your manifest file. Visit Vulert Scanner to check your application without needing to sign up.
The CVSS score for CVE-2017-15095 is 9.8, indicating a critical level of risk.
Implement input validation to sanitize data being deserialized as a temporary workaround until you can upgrade to a secure version.
Related vulnerabilities
Recent vulnerabilities recorded for jackson-databind.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
