{"id":"CVE-2017-15095","url":"https://www.cyber-defence.io/tools/cve/CVE-2017-15095","generatedAt":"2026-10-28T20:08:58.479Z","title":"A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.","description":"A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaw CVE-2017-7525 by blacklisting more classes that could be used maliciously.","published":"2018-02-06T15:29:00.000Z","lastModified":"2026-10-08T22:16:40.000Z","status":"Modified","sourceIdentifier":"secalert@redhat.com","cvss":{"version":"3.1","score":9.8,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"cwe":["CWE-184","CWE-502"],"affected":["fasterxml/jackson-databind","debian/debian linux","redhat/openshift container platform","redhat/satellite","redhat/satellite capsule","redhat/jboss enterprise application platform","netapp/oncommand balance","netapp/oncommand performance manager","netapp/oncommand shift","netapp/snapcenter","oracle/banking platform","oracle/clusterware","oracle/communications billing and revenue management","oracle/communications diameter signaling router","oracle/communications instant messaging server","oracle/database server","oracle/enterprise manager for virtualization","oracle/financial services analytical applications infrastructure","oracle/global lifecycle management opatchauto","oracle/identity manager","oracle/jd edwards enterpriseone tools","oracle/primavera unifier","oracle/utilities advanced spatial and operational analytics","oracle/webcenter portal"],"epss":{"score":0.08357,"percentile":0.94933,"date":"2026-10-27","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (8.36%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[],"references":[{"url":"http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","tags":["Patch","Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","tags":["Patch","Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","tags":["Patch","Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"http://www.securityfocus.com/bid/103880","tags":["Third Party Advisory","VDB Entry"],"source":"secalert@redhat.com"},{"url":"http://www.securitytracker.com/id/1039769","tags":["Third Party Advisory","VDB Entry"],"source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2017:3189","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2017:3190","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2018:0342","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2018:0478","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2018:0479","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2018:0480","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2018:0481","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2018:0576","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2018:0577","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2018:1447","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2018:1448","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2018:1449","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2018:1450","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2018:1451","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2018:2927","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2019:2858","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2019:3149","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2019:3892","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"https://github.com/FasterXML/jackson-databind/issues/1680","tags":["Issue Tracking","Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"https://github.com/FasterXML/jackson-databind/issues/1737","tags":["Issue Tracking","Patch","Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"https://lists.apache.org/thread.html/f095a791bda6c0595f691eddd0febb2d396987eec5cbd29120d8c629%40%3Csolr-user.lucene.apache.org%3E","source":"secalert@redhat.com"},{"url":"https://lists.debian.org/debian-lts-announce/2020/01/msg00037.html","tags":["Mailing List","Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"https://security.netapp.com/advisory/ntap-20171214-0003/","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"https://www.debian.org/security/2017/dsa-4037","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"https://www.oracle.com/security-alerts/cpuoct2020.html","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","tags":["Patch","Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","tags":["Patch","Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","tags":["Patch","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","tags":["Patch","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","tags":["Patch","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securityfocus.com/bid/103880","tags":["Third Party Advisory","VDB Entry"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securitytracker.com/id/1039769","tags":["Third Party Advisory","VDB Entry"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2017:3189","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2017:3190","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2018:0342","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2018:0478","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2018:0479","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2018:0480","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2018:0481","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2018:0576","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2018:0577","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2018:1447","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2018:1448","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2018:1449","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2018:1450","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2018:1451","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2018:2927","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2019:2858","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2019:3149","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2019:3892","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/FasterXML/jackson-databind/issues/1680","tags":["Issue Tracking","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/FasterXML/jackson-databind/issues/1737","tags":["Issue Tracking","Patch","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.apache.org/thread.html/f095a791bda6c0595f691eddd0febb2d396987eec5cbd29120d8c629%40%3Csolr-user.lucene.apache.org%3E","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2020/01/msg00037.html","tags":["Mailing List","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.netapp.com/advisory/ntap-20171214-0003/","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2017-15095","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}