EXPOSURES › CVE-2017-15095
CVE-2017-15095
CRITICAL
DETAIL
SourceNVD · cve
Published2018-02-06
CVSS9.8
Referencehttps://nvd.nist.gov/vuln/detail/CVE-2017-15095 ↗
▸ RECOMMENDED ACTION Critical severity — schedule patching of the affected products.
PLAYERS IMPLICATED
NetApp · vendorOracle · vendordebian · vendorfasterxml · vendorredhat · vendorbanking platform · productclusterware · productcommunications billing and revenue management · productcommunications diameter signaling router · productcommunications instant messaging server · productdatabase server · productdebian linux · productenterprise linux · productenterprise manager for virtualization · productfinancial services analytical applications infrastructure · productglobal lifecycle management opatchauto · productidentity manager · productjackson-databind · productjboss enterprise application platform · productjd edwards enterpriseone tools · productoncommand balance · productoncommand performance manager · productoncommand shift · productopenshift container platform · productprimavera unifier · productsatellite · productsatellite capsule · productsnapcenter · productutilities advanced spatial and operational analytics · productwebcenter portal · product
DESCRIPTION
A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaw CVE-2017-7525 by blacklisting more classes that could be used maliciously.
SENTIMENT · TRUSTED SOURCES
synthesis
neutral
+0.00
No sentiment expressed; technical vulnerability report only.
Neutral; purely technical description of CVE.
"A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper."
Neutral; no content available.
AFFECTED FEDRAMP PRODUCTS · 11
| PRODUCT | STATUS |
|---|---|
| Aconex for Defense Oracle |
Authorized |
| Cloud Insights NetApp |
In Process |
| Federal Managed Cloud Services Oracle |
Authorized |
| Fusion Cloud Oracle |
Authorized |
| Government Cloud - Common Controls Oracle |
Authorized |
| Oracle Cloud Infrastructure-Government Cloud Oracle |
Authorized |
| Oracle Enterprise Performance Management (EPM) Oracle |
Authorized |
| Oracle Enterprise Performance Management (EPM) - Moderate Oracle |
In Process |
| Oracle Service Cloud Oracle |
Authorized |
| Oracle Service Cloud (DOD) Oracle |
Authorized |
| Taleo Cloud - U.S. Government Cloud Oracle |
Authorized |