CVE-2017-17485 jackson-databind vulnerable to remote code execution due to incorrect deserialization and blocklist bypass
Attackers can achieve remote code execution by sending malicious JSON to the ObjectMapper, bypassing blacklist protections in the Jackson library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-17485?
CVE-2017-17485 is a critical unsafe deserialization vulnerability in Debian Debian Linux, published on 10 Jan 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the Spring libraries are available in the classpath.
Weakness: CWE-502
Which versions are affected by CVE-2017-17485?
6 open source packages ship an affected version, including com.fasterxml.jackson.core:jackson-databind. It affects 8 products.
| Package | Affected | Fixed in |
|---|---|---|
com.fasterxml.jackson.core:jackson-databind Maven | All versions | 2.7.9.2 |
com.fasterxml.jackson.core:jackson-databind Maven | All versions | 2.7.9.2 |
com.fasterxml.jackson.core:jackson-databind Maven | From 2.8.0 | 2.8.11 |
com.fasterxml.jackson.core:jackson-databind Maven | From 2.8.0 | 2.8.11 |
com.fasterxml.jackson.core:jackson-databind Maven | From 2.9.0 | 2.9.4 |
com.fasterxml.jackson.core:jackson-databind Maven | From 2.9.0 | 2.9.4 |
Linux distribution packages (2)
rh-eclipse46-jackson-databind Red Hat:rhel_software_collections:3::el7 | All versions | 0:2.6.3-2.6.el7 |
rh-eclipse46-jackson-databind-javadoc Red Hat:rhel_software_collections:3::el7 | All versions | 0:2.6.3-2.6.el7 |
Products include Debian Debian Linux, Fasterxml Jackson-Databind, Netapp E-Series Santricity Os Controller, Netapp E-Series Santricity Web Services Proxy, Netapp Oncommand Shift, Netapp Snapcenter and 2 more.
How do I fix CVE-2017-17485?
Upgrade com.fasterxml.jackson.core:jackson-databind to a fixed version for your release line: 2.7.9.2, 2.8.11 or 2.9.4.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2017-17485 being exploited?
There is no known exploitation of CVE-2017-17485 in the wild and no public exploit code.
Public exploit code: 3 proofs of concept on GitHub.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as CLEANSTART-2026-IG26224, DEBIAN-CVE-2017-17485, GHSA-rfx6-vp9g-rh7v, RHSA-2018:0116, ROOT-APP-MAVEN-CVE-2017-17485, UBUNTU-CVE-2017-17485.