CVE-2017-15095 jackson-databind
| Affected software | jackson-databind |
|---|---|
| Severity | 9.8 Critical CVSS 3.1 2 scores |
| Fixed in | 2.8.11, 2.9.4, 2.6.7.3, 2.7.9.2 |
| Weakness | Deserialization of untrusted data (CWE-502) |
| Published | 6 Feb 2018 |
| Updated | 8 Oct 2026 |
Description
A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaw CVE-2017-7525 by blacklisting more classes that could be used maliciously.
CWE-184
Exploitation status
No public exploit
No exploit has been reported in the sources we check. Published 8 years ago.
Exploitation status
- CISA KEV not listed
- VulnCheck KEV not listed
- CISA Vulnrichment exploitation: none
- Indexed PoC none indexed
- EPSS 8.4% chance in 30 days
Waratek protection
Waratek has a rule that blocks attacks on this vulnerability.
- Protection full
- Action available patch rule
- Review human ARMR file
- Record active
| Decided by | An ARMR patch file on disk for this CVE |
|---|---|
| Finding | CVE is covered by a multi-CVE ARMR patch rule |
ARMR rule files
1 fileThe rule files Waratek ships for this CVE. Some CVEs need more than one, for example one per affected library or one per ARMR version.
CVE-2017-15095.armr patch rule, ARMR 2.6 added 2020-06-25 updated 2026-03-04How to mitigate CVE-2017-15095
Upgrade jackson-databind to a release that fixes it: 2.8.11, 2.9.4, 2.6.7.3 or 2.7.9.2. Until you can, Waratek RASP blocks exploitation with a rule written for this CVE. It runs inside the Java application, with no code changes.
Waratek RASP Runtime protection for Java applications
CVSS
9.8 CRITICAL
v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
2 metrics
CVSS
9.8 CRITICAL v3.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
2 metrics
We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.
| Version | Score | Band | Vector | Assigner | Type | |
|---|---|---|---|---|---|---|
| CVSS 3.1 | 9.8 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
NVD | Primary | published |
| CVSS 2.0 | 7.5 | none | AV:N/AC:L/Au:N/C:P/I:P/A:P |
NVD | Primary |
Affected software and releases
Oracle advisories
| Advisory | Type | Quarter | Products Oracle names in its risk matrix |
|---|---|---|---|
| Oracle Critical Patch Update January 2019 ↗ | CPU | 2019-Q1 | Oracle Communications Applications / Security (jackson-databind) (prior to 8.3) |
| Oracle Critical Patch Update October 2018 ↗ | CPU | 2018-Q4 | Oracle Communications Applications / Security (jackson-databind) (Prior to 10.0.1) Oracle Fusion Middleware / Installer (jackson-databind) (11.1.2.3.0, 12.2.1.3.0) Oracle JD Edwards Products / Business Logic Inf (jackson-databind) (9.2) Oracle JD Edwards Products / Monitoring and Diagnostics (jackson-databind) (9.2) Oracle Retail Applications / Framework (jackson-databind) (5.3.0, 6.0.0, 6.0.1) |
| Oracle Critical Patch Update July 2018 ↗ | CPU | 2018-Q3 | Oracle Database Server / Oracle Spatial (jackson-databind) (12.2.0.1, 18.1) |
| Oracle Critical Patch Update April 2018 ↗ | CPU | 2018-Q2 | Oracle Communications Applications / REST (jackson-databind) (8.x) Oracle Communications Applications / WCAP (jackson-databind) (8.x) Oracle Construction and Engineering Suite / Core (jackson-databind) (16.x, 17.x) Oracle Enterprise Manager Products Suite / Generic Virtualization (jackson-databind) (13.2) Oracle Financial Services Applications / Infrastructure (jackson-databind) (2.4, 2.5, 2.6) Oracle Financial Services Applications / Infrastructure (jackson-databind) (2.6) Oracle Financial Services Applications / Infrastructure (jackson-databind) (2.6) Oracle Financial Services Applications / Infrastructure (jackson-databind) (2.6) Oracle Fusion Middleware / Security Framework (jackson-databind) (12.2.1.2.0, 12.2.1.3.0) Oracle JD Edwards Products / EnterpriseOne Mobility Sec (jackson-databind) (9.2) Oracle Retail Applications / System Administration (jackson-databind) (5.2) Oracle Retail Applications / Xenvironment (jackson-databind) (6.5.11, 7.0.6, 7.1.6, 15.0.1, 16.0.2) Oracle Supply Chain Products Suite / Web Client (CS) (9.3.6) |
Oracle components and versions
| Family | Component | Versions, as Oracle lists them | Read as |
|---|---|---|---|
| Oracle Communications Applications | REST (jackson-databind) | 8.x | 8 |
| Oracle Communications Applications | Security (jackson-databind) | prior to 8.3 | |
| Oracle Communications Applications | WCAP (jackson-databind) | 8.x | 8 |
| Oracle Construction and Engineering Suite | Core (jackson-databind) | 16.x, 17.x | 16 · 17 |
| Oracle Database Server | Oracle Spatial (jackson-databind) | 12.2.0.1, 18.1 | 12.2.0.1 · 18.1 |
| Oracle Enterprise Manager Products Suite | Generic Virtualization (jackson-databind) | 13.2 | 13.2 |
| Oracle Financial Services Applications | Infrastructure (jackson-databind) | 2.4, 2.5, 2.6 | 2.4 · 2.5 · 2.6 |
| Oracle Fusion Middleware | Installer (jackson-databind) | 11.1.2.3.0, 12.2.1.3.0 | 11.1.2.3.0 · 12.2.1.3.0 |
| Oracle Fusion Middleware | Security Framework (jackson-databind) | 12.2.1.2.0, 12.2.1.3.0 | 12.2.1.2.0 · 12.2.1.3.0 |
| Oracle JD Edwards Products | Business Logic Inf (jackson-databind) | 9.2 | 9.2 |
| Oracle JD Edwards Products | EnterpriseOne Mobility Sec (jackson-databind) | 9.2 | 9.2 |
| Oracle JD Edwards Products | Monitoring and Diagnostics (jackson-databind) | 9.2 | 9.2 |
| Oracle Retail Applications | Framework (jackson-databind) | 5.3.0, 6.0.0, 6.0.1 | 5.3.0 · 6.0.0 · 6.0.1 |
| Oracle Retail Applications | System Administration (jackson-databind) | 5.2 | 5.2 |
| Oracle Retail Applications | Xenvironment (jackson-databind) | 6.5.11, 7.0.6, 7.1.6, 15.0.1, 16.0.2 | 6.5.11 · 7.0.6 · 7.1.6 · 15.0.1 · 16.0.2 |
| Oracle Supply Chain Products Suite | Web Client (CS) | 9.3.6 | 9.3.6 |
Maven packages
Affected and fixed versions, from OSV.dev| Package | Introduced | Fixed | Last affected |
|---|---|---|---|
com.fasterxml.jackson.core:jackson-databind |
2.8.0 | 2.8.11 |
unbounded |
com.fasterxml.jackson.core:jackson-databind |
2.9.0 | 2.9.4 |
unbounded |
com.fasterxml.jackson.core:jackson-databind |
2.0.0 | 2.6.7.3 |
unbounded |
com.fasterxml.jackson.core:jackson-databind |
2.7.0 | 2.7.9.2 |
unbounded |
Products and versions
25 products, 55 version entries| Source | Vendor | Product | Scheme | Affected versions |
|---|---|---|---|---|
| osv | com.fasterxml.jackson.core | jackson-databind | generic | ≥ 2.0.0 and ＜ 2.6.7.3 · ≥ 2.7.0 and ＜ 2.7.9.2 · ≥ 2.8.0 and ＜ 2.8.11 · ≥ 2.9.0 and ＜ 2.9.4 |
| nvd | debian | debian linux | generic | 8.0 · 9.0 |
| nvd | fasterxml | jackson-databind | generic | ≥ 2.0.0 and ＜ 2.6.7.2 · ≥ 2.7.0 and ＜ 2.7.9.2 · ≥ 2.8.0 and ＜ 2.8.10 · 2.9.0 · 2.9.0:prerelease1 · 2.9.0:prerelease2 · 2.9.0:prerelease3 · 2.9.0:prerelease4 |
| nvd | netapp | oncommand balance | generic | any version |
| nvd | netapp | oncommand performance manager | generic | any version |
| nvd | netapp | oncommand shift | generic | any version |
| nvd | netapp | snapcenter | generic | any version |
| nvd | oracle | banking platform | generic | 2.5.0 · 2.6.0 · 2.6.1 · 2.6.2 |
| nvd | oracle | clusterware | generic | 12.1.0.2.0 |
| nvd | oracle | communications billing and revenue management | generic | 7.5 · 12.0 |
| nvd | oracle | communications diameter signaling router | generic | ＜ 8.3 |
| nvd | oracle | communications instant messaging server | generic | 10.0.1.2.0 |
| nvd | oracle | database server | generic | 12.2.0.1 · 18.1 |
| nvd | oracle | enterprise manager for virtualization | generic | 13.2.2 · 13.2.3 · 13.3.1 |
| nvd | oracle | financial services analytical applications infrastructure | generic | 8.0.2 · 8.0.3 · 8.0.4 · 8.0.5 · 8.0.6 · 8.0.7 |
| nvd | oracle | global lifecycle management opatchauto | generic | ＜ 12.2.0.1.14 |
| nvd | oracle | identity manager | generic | 11.1.2.3.0 · 12.2.1.3.0 |
| nvd | oracle | jd edwards enterpriseone tools | generic | 9.2 |
| nvd | oracle | primavera unifier | generic | 16.1 · 16.2 · ≥ 17.1 and ≤ 17.12 · 18.8 |
| nvd | oracle | utilities advanced spatial and operational analytics | generic | 2.7.0.1 |
| nvd | oracle | webcenter portal | generic | 12.2.1.3.0 |
| nvd | redhat | jboss enterprise application platform | generic | 6.0.0 · 6.4.0 · 7.1.0 |
| nvd | redhat | openshift container platform | generic | 3.11 · 4.1 |
| nvd | redhat | satellite | generic | 6.4 |
| nvd | redhat | satellite capsule | generic | 6.4 |
References
Timeline
Timeline
| Published | 2018-02-06 | By the CVE Program. |
|---|---|---|
| ARMR remediation created | 2020-06-25 | Earliest commit adding this CVE's ARMR patch or security rule. |
| ARMR remediation last updated | 2026-03-04 | Most recent commit touching this CVE's ARMR patch or security rule. |
| Last VRT activity | 2026-03-04 | Most recent commit touching this CVE's classification, patch or rule file. |
| NVD record modified | 2026-10-08 | NVD's own last-modified date for this record. |