CVE-2017-15095

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 8.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-02-06 · updated 2026-10-08
Weakness: CWE-184

Description

A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaw CVE-2017-7525 by blacklisting more classes that could be used maliciously.

Affected products

Debian Linux: 8.0, 9.0
FasterXML jackson-databind: from 2.0.0 before 2.6.7.2; from 2.7.0 before 2.7.9.2; from 2.8.0 before 2.8.10; 2.9.0, 2.9.0-prerelease1, 2.9.0-prerelease2, 2.9.0-prerelease3, 2.9.0-prerelease4 — fixed in 2.6.7.2, 2.7.9.2, 2.8.10
NetApp Oncommand Balance: all versions
NetApp Oncommand Performance Manager: all versions
NetApp Oncommand Shift: all versions
NetApp SnapCenter: all versions
Oracle Banking Platform: 2.5.0, 2.6.0, 2.6.1, 2.6.2
Oracle Clusterware: 12.1.0.2.0
Oracle Corporation Communications Billing and Revenue Management: 7.5, 12.0
Oracle Corporation Communications Diameter Signaling Router (DSR): before 8.3 — fixed in 8.3
Oracle Communications Instant Messaging Server: 10.0.1.2.0
Oracle Database: 12.2.0.1, 18.1
Oracle Enterprise Manager For Virtualization: 13.2.2, 13.2.3, 13.3.1
Oracle Corporation Financial Services Analytical Applications Infrastructure: 8.0.2, 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.0.7
Oracle Global Lifecycle Management Opatchauto: before 12.2.0.1.14 — fixed in 12.2.0.1.14
Oracle Corporation Oracle Identity Manager: 11.1.2.3.0, 12.2.1.3.0
Oracle Corporation JD Edwards EnterpriseOne Tools: 9.2
Oracle Corporation Primavera Unifier: from 17.1 through 17.12; 16.1, 16.2, 18.8
Oracle Utilities Advanced Spatial And Operational Analytics: 2.7.0.1
Oracle Corporation Oracle WebCenter Portal: 12.2.1.3.0
Red Hat JBoss EAP: 6.0.0, 6.4.0, 7.1.0
Red Hat OpenShift Container Platform 4.18: 3.11, 4.1
Red Hat Satellite 6: 6.4
RedHat Satellite Capsule: 6.4

How to fix

Upgrade to a fixed version: FasterXML jackson-databind 2.6.7.2, 2.7.9.2, 2.8.10; Oracle Corporation Communications Diameter Signaling Router (DSR) 8.3; Oracle Global Lifecycle Management Opatchauto 12.2.0.1.14. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2017-15095 or the next vulnerability affects your stack