FasterXML Jackson-databind CVE-2017-15095 Incomplete Fix Remote Code Execution Vulnerability

Bugtraq ID:	103880
Class:	Design Error
CVE:	CVE-2017-15095
Remote:	Yes
Local:	No
Published:	Nov 02 2017 12:00AM
Updated:	Jan 16 2019 09:00AM
Credit:	Liao Xinxi (NSFOCUS)
Vulnerable:	Redhat Software Collections 1 for RHEL 7 0 Redhat Software Collections 1 for RHEL 7.4 Redhat Software Collections 1 for RHEL 7.3 Redhat Redhat JBoss Enterprise Application Platform (for RHEL 7) 7.1 Redhat Redhat JBoss Enterprise Application Platform (for RHEL 6) 7.1 Redhat JBoss Middleware Text-Only Advisories for MIDDLEWARE 0 Redhat JBoss Enterprise Application Platform Text-Only Advisories 0 Redhat Developer Tools (for RHEL Workstation) 1 Redhat Developer Tools (for RHEL Server) 1 Oracle WebCenter Portal 12.2.1.3.0 Oracle WebCenter Portal 12.2.1.2.0 Oracle Retail Xstore Point of Service 16.0.3 Oracle Retail Xstore Point of Service 15.0.2 Oracle Retail Xstore Point of Service 7.1.7 Oracle Retail Xstore Point of Service 7.0.7 Oracle Retail Xstore Point of Service 6.5.12 Oracle Retail Order Broker 5.2 Oracle Retail Open Commerce Platform 6.0.1 Oracle Retail Open Commerce Platform 6.0 Oracle Retail Open Commerce Platform 5.3 Oracle Primavera Unifier 17.0 Oracle Primavera Unifier 16.2 Oracle Primavera Unifier 16.1 Oracle Primavera Unifier 16.0 Oracle Primavera Gateway 17.12 Oracle Primavera Gateway 16.2 Oracle Primavera Gateway 15.2 Oracle JD Edwards EnterpriseOne Tools 9.2.2 Oracle JD Edwards EnterpriseOne Tools 9.2 Oracle Identity Manager 12.2.1.3.0 Oracle Identity Manager 11.1.2.3.0 Oracle Financial Services Market Risk Measurement and Management 8.0.5 Oracle Financial Services Hedge Management and IFRS Valuations 8.0.5 Oracle Financial Services Hedge Management and IFRS Valuations 8.0.4 Oracle Financial Services Analytical Applications Infrastructure 8.0.3 Oracle Financial Services Analytical Applications Infrastructure 8.0.2 Oracle Financial Services Analytical Applications Infrastructure 8.0.1 Oracle Financial Services Analytical Applications Infrastructure 8.0 Oracle Enterprise Manager for Virtualization 13.2 Oracle Database 18c 0 Oracle Communications Instant Messaging Server 10.0 Oracle Communications Diameter Signaling Router 7.1 Oracle Communications Diameter Signaling Router 6.0.2 Oracle Communications Diameter Signaling Router 6.0 Oracle Communications Diameter Signaling Router 5.1 Oracle Communications Diameter Signaling Router 4.1.6 Oracle Communications Diameter Signaling Router 4.1 Oracle Communications Diameter Signaling Router 8.0 Oracle Communications Diameter Signaling Router 7.0 Oracle Communications Diameter Signaling Router 5.0 Oracle Communications Diameter Signaling Router 4.0 Oracle Communications Diameter Signaling Router 3.0 Oracle Communications Contacts Server 8.0 Oracle Communications Calendar Server 8.0 Oracle Banking Platform 2.6 Oracle Banking Platform 2.5 Oracle Banking Platform 2.4 Oracle Banking Enterprise Product Manufacturing 2.6 Oracle Banking Enterprise Originations 2.6 Oracle Banking Enterprise Collections 2.6 Oracle Agile PLM Framework 9.3.6 FasterXML jackson-databind 2.9 FasterXML jackson-databind 2.8.9 FasterXML jackson-databind 2.8.8 FasterXML jackson-databind 2.8.7 FasterXML jackson-databind 2.8.8.1 FasterXML jackson-databind 2.7.9.1 FasterXML jackson-databind 2.6.7.1 Debian Linux 9.0 Debian Linux 8.0
Not Vulnerable:	Redhat Software Collections for RHEL 7.4 EUS Redhat Software Collections for RHEL 7.3 EUS Redhat Software Collections for RHEL 7 Oracle Communications Instant Messaging Server 10.0.1 Oracle Communications Diameter Signaling Router 8.3 FasterXML jackson-databind 2.9.2 FasterXML jackson-databind 2.9.1 FasterXML jackson-databind 2.8.10

FasterXML Jackson-databind CVE-2017-15095 Incomplete Fix Remote Code Execution Vulnerability

FasterXML Jackson-databind is prone to a remote-code execution vulnerability.

Successfully exploiting this issue allows attackers to execute arbitrary code in the context of the affected application. Failed exploits will result in denial-of-service conditions.

This issue has been fixed in Jackson-databind 2.8.10 and 2.9.2.

FasterXML Jackson-databind CVE-2017-15095 Incomplete Fix Remote Code Execution Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

FasterXML Jackson-databind CVE-2017-15095 Incomplete Fix Remote Code Execution Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

FasterXML Jackson-databind CVE-2017-15095 Incomplete Fix Remote Code Execution Vulnerability

References:

• FasterXML/jackson-databind Home Page (FasterXML)
  
• Block more JDK types from polymorphic deserialization (CVE 2017-15095) #1737 (FasterXML)
  
• Bug 1506612 - (CVE-2017-15095) CVE-2017-15095 jackson-databind (Redhat)
  
• CVE-2017-15095 (Redhat)
  
• DSA-4004-1 jackson-databind -- security update (Debian)
  
• Oracle Critical Patch Update Advisory - April 2018 (Oracle)
  
• Oracle Critical Patch Update Advisory - January 2019 (Oracle)
  
• Oracle Critical Patch Update Advisory - October 2018 (Oracle)
  
• RHSA-2017:3189 - Security Advisory (Redhat)
  
• RHSA-2017:3190 - Security Advisory (Redhat)
  
• RHSA-2018:0342 - Security Advisory (Redhat)
  
• RHSA-2018:0478 - Security Advisory (Redhat)
  
• RHSA-2018:0479 - Security Advisory (Redhat)
  
• RHSA-2018:0480 - Security Advisory (Redhat)
  
• RHSA-2018:0481 - Security Advisory (Redhat)
  
• RHSA-2018:0576 - Security Advisory (Redhat)
  
• RHSA-2018:0577 - Security Advisory (Redhat)