CVE-2017-15095

CriticalCVSS 9.8/10Last modified Oct 8, 2026

Description

A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaw CVE-2017-7525 by blacklisting more classes that could be used maliciously.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-184CWE-502

Affected software

No affected versions have been published.

Timeline

Published
Feb 6, 2018
Last modified
Oct 8, 2026
NVD status
Modified

Related CVEs from 2017

CVE-2017-150963.3A flaw was found in GlusterFS in versions prior to 3.10. A null pointer dereference in send_brick_req function in glusterfsd/src/gf_attach.cCVE-2017-150976.7Privilege escalation flaws were found in the Red Hat initialization scripts of PostgreSQL. An attacker with access to the postgres user accoCVE-2017-150988.1Invalid json_populate_recordset or jsonb_populate_recordset function calls in PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before CVE-2017-150996.5INSERT ... ON CONFLICT DO UPDATE commands in PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, and 9.5.x before 9.5.10 disclose table contentCVE-2017-151006.1An attacker submitting facts to the Foreman server containing HTML can cause a stored XSS on certain pages: (1) Facts page, when clicking onCVE-2017-151019.8A missing patch for a stack-based buffer overflow in findTable() was found in Red Hat version of liblouis before 2.5.4. An attacker could caCVE-2017-151026.3The tower_probe function in drivers/usb/misc/legousbtower.c in the Linux kernel before 4.8.1 allows local users (who are physically proximatCVE-2017-151038.8A security-check flaw was found in the way the Heketi 5 server API handled user requests. An authenticated Heketi user could send specially CVE-2017-151047.8An access flaw was found in Heketi 5, where the heketi.json configuration file was world readable. An attacker having local access to the HeCVE-2017-151055.3A flaw was found in the way unbound before 1.6.8 validated wildcard-synthesized NSEC records. An improperly validated wildcard NSEC record cCVE-2017-151077.5A vulnerability was found in the implementation of DNSSEC in Dnsmasq up to and including 2.78. Wildcard synthesized NSEC records could be imCVE-2017-151087.8spice-vdagent up to and including 0.17.0 does not properly escape save directory before passing to shell, allowing local attacker with acces
CVE-2017-15095: Critical severity, CVSS 9.8 | Vulnix