A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.
Fix
Public exploits 5
- Dannners/jackson-deserialization-2017-7525 PoC on GitHub
- Ingenuity-Fainting-Goats/CVE-2017-7525-Jackson-Deserialization-Lab PoC on GitHub
- JavanXD/Demo-Exploit-Jackson-RCE PoC on GitHub
- Nazicc/S2-055 PoC on GitHub
- SecureSkyTechnology/study-struts2-s2-054_055-jackson-cve-2017-7525_cve-2017-15095 PoC on GitHub
Each line links to the index that lists it, never to exploit code. Exploit-DB's "verified" and a Metasploit rank of good or better count as verified; a PoC-in-GitHub entry is a repository's claim.
Patch, vendor advisory and mitigation references on NVD 14
- http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html Patch, Third Party Advisory
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html Patch, Third Party Advisory
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html Patch, Third Party Advisory
- https://github.com/FasterXML/jackson-databind/issues/1599 Issue Tracking, Patch, Third Party Advisory
- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html Patch, Third Party Advisory
- https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html Patch, Third Party Advisory
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html Patch, Third Party Advisory
- http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html Patch, Third Party Advisory
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html Patch, Third Party Advisory
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html Patch, Third Party Advisory
- https://github.com/FasterXML/jackson-databind/issues/1599 Issue Tracking, Patch, Third Party Advisory
- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html Patch, Third Party Advisory
- https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html Patch, Third Party Advisory
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html Patch, Third Party Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 9.8 · fasterxml, debian, netappNVD modified 2026-10-08 22:16
Affected (CPE criteria) 44
cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*cpe:2.3:a:fasterxml:jackson-databind:2.9.0:prerelease1:*:*:*:*:*:*cpe:2.3:a:fasterxml:jackson-databind:2.9.0:prerelease2:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*cpe:2.3:a:netapp:oncommand_balance:-:*:*:*:*:*:*:*cpe:2.3:a:netapp:oncommand_performance_manager:-:*:*:*:*:linux:*:*cpe:2.3:a:netapp:oncommand_performance_manager:-:*:*:*:*:vmware_vsphere:*:*cpe:2.3:a:netapp:oncommand_shift:-:*:*:*:*:*:*:*cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:*cpe:2.3:a:redhat:openshift_container_platform:4.1:*:*:*:*:*:*:*cpe:2.3:a:redhat:virtualization:4.0:*:*:*:*:*:*:*cpe:2.3:a:redhat:virtualization_host:4.0:*:*:*:*:*:*:*cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.0.0:*:*:*:*:*:*:*cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.4.0:*:*:*:*:*:*:*cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0:*:*:*:*:*:*:*cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.1:*:*:*:*:*:*:*cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:*cpe:2.3:a:oracle:banking_platform:2.5.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:banking_platform:2.6.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:banking_platform:2.6.1:*:*:*:*:*:*:*cpe:2.3:a:oracle:banking_platform:2.6.2:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_billing_and_revenue_management:7.5:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_billing_and_revenue_management:12.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_communications_policy_management:*:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_diameter_signaling_route:*:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_instant_messaging_server:10.0.1:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_instant_messaging_server:10.0.1.2.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:enterprise_manager_for_virtualization:13.2.2:*:*:*:*:*:*:*cpe:2.3:a:oracle:enterprise_manager_for_virtualization:13.2.3:*:*:*:*:*:*:*cpe:2.3:a:oracle:enterprise_manager_for_virtualization:13.3.1:*:*:*:*:*:*:*cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.2.0.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.3.0.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.4.0.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.5.0.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.6.0.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.7.0.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:global_lifecycle_management_opatchauto:*:*:*:*:*:*:*:*cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:*cpe:2.3:a:oracle:primavera_unifier:16.1:*:*:*:*:*:*:*- and 4 more
References 120
- http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html Patch, Third Party Advisory
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html Patch, Third Party Advisory
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html Patch, Third Party Advisory
- http://www.securityfocus.com/bid/99623 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1039744 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1039947 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1040360 Third Party Advisory, VDB Entry
- https://access.redhat.com/errata/RHSA-2017:1834 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2017:1835 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2017:1836 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2017:1837 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2017:1839 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2017:1840 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2017:2477 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2017:2546 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2017:2547 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2017:2633 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2017:2635 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2017:2636 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2017:2637 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2017:2638 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2017:3141 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2017:3454 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2017:3455 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2017:3456 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2017:3458 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:0294 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:0342 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:1449 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:1450 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:0910 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2858 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:3149 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1462702 Issue Tracking, Third Party Advisory
- https://cwiki.apache.org/confluence/display/WW/S2-055 Third Party Advisory
- https://github.com/FasterXML/jackson-databind/issues/1599 Issue Tracking, Patch, Third Party Advisory
- https://github.com/FasterXML/jackson-databind/issues/1723 Issue Tracking, Third Party Advisory
- https://lists.apache.org/thread.html/3c87dc8bca99a2b3b4743713b33d1de05b1d6b761fdf316224e9c81f%40%3Cdev.lucene.apache.org%3E
- https://lists.apache.org/thread.html/4641ed8616ccc2c1fbddac2c3dc9900c96387bc226eaf0232d61909b%40%3Ccommits.cassandra.apache.org%3E
- https://lists.apache.org/thread.html/5008bcbd45ee65ce39e4220b6ac53d28a24d6bc67d5804e9773a7399%40%3Csolr-user.lucene.apache.org%3E
- https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451%40%3Csolr-user.lucene.apache.org%3E
- https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe%40%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/b1f33fe5ade396bb903fdcabe9f243f7692c7dfce5418d3743c2d346%40%3Cdev.lucene.apache.org%3E
- https://lists.apache.org/thread.html/c10a2bf0fdc3d25faf17bd191d6ec46b29a353fa9c97bebd7c4e5913%40%3Cdev.lucene.apache.org%3E
- https://lists.apache.org/thread.html/c2ed4c0126b43e324cf740012a0edd371fd36096fd777be7bfe7a2a6%40%3Cdev.lucene.apache.org%3E
- https://lists.apache.org/thread.html/c9d5ff20929e8a3c8794facf4c4b326a9c10618812eec356caa20b87%40%3Csolr-user.lucene.apache.org%3E
- https://lists.apache.org/thread.html/f095a791bda6c0595f691eddd0febb2d396987eec5cbd29120d8c629%40%3Csolr-user.lucene.apache.org%3E
- https://lists.apache.org/thread.html/f60afd3c7e9ebaaf70fad4a4beb75cf8740ac959017a31e7006c7486%40%3Cdev.lucene.apache.org%3E
- https://lists.apache.org/thread.html/r42ac3e39e6265db12d9fc6ae1cd4b5fea7aed9830dc6f6d58228fed7%40%3Ccommits.cassandra.apache.org%3E
- https://lists.apache.org/thread.html/r68acf97f4526ba59a33cc6e592261ea4f85d890f99e79c82d57dd589%40%3Cissues.spark.apache.org%3E
- https://lists.apache.org/thread.html/rf7f87810c38dc9abf9f93989f76008f504cbf7c1a355214640b2d04c%40%3Ccommits.cassandra.apache.org%3E
- https://lists.debian.org/debian-lts-announce/2020/01/msg00037.html Mailing List, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2020/08/msg00039.html Mailing List, Third Party Advisory
- https://security.netapp.com/advisory/ntap-20171214-0002/ Third Party Advisory
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03902en_us Third Party Advisory
- https://www.debian.org/security/2017/dsa-4004 Third Party Advisory
- https://www.oracle.com/security-alerts/cpuoct2020.html Third Party Advisory
- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html Patch, Third Party Advisory
- https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html Patch, Third Party Advisory
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html Patch, Third Party Advisory