{"id":"CVE-2017-17485","published":"2018-01-10T18:00:00Z","modified":"2025-08-27T20:31:49Z","title":"FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because…","vendor":null,"product":null,"tier":"tail","description":{"text":"FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the Spring libraries are available in the classpath.","provenance":"source","from":"CVE.org"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CISA ADP Vulnrichment"},"epss":{"score":0.49727,"percentile":0.98896,"provenance":"source"},"cwes":[{"id":"CWE-502","name":"Deserialization of Untrusted Data"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2018:1448","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2018:0479","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2018:0481","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2018:1449","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2018:1450","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2018:1451","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2018:0116","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2018:0342","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://www.securityfocus.com/archive/1/541652/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ"]},{"url":"https://access.redhat.com/errata/RHSA-2018:0480","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2018:1447","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://www.debian.org/security/2018/dsa-4114","tags":["vendor-advisory","x_refsource_DEBIAN"]},{"url":"https://access.redhat.com/errata/RHSA-2018:0478","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2018:2930","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2019:1782","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2019:1797","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2019:2858","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2019:3149","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2019:3892","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2020.html","tags":["x_refsource_MISC"]},{"url":"https://security.netapp.com/advisory/ntap-20180201-0003/","tags":["x_refsource_CONFIRM"]},{"url":"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03902en_us","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/FasterXML/jackson-databind/issues/1855","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/irsl/jackson-rce-via-spel/","tags":["x_refsource_MISC"]}],"priority":{"score":31.6,"factors":[{"name":"EPSS percentile","points":19.78},{"name":"Public exploit code","points":5.0},{"name":"CVSS severity","points":6.86}]},"exploitSources":{"pocGithub":{"count":2,"skipped":1,"earliest":"2019-04-21","earliestUrl":"https://github.com/x7iaob/cve-2017-17485","repos":[{"name":"Al1ex/CVE-2017-17485","url":"https://github.com/Al1ex/CVE-2017-17485","stars":2,"created":"2020-05-22"},{"name":"x7iaob/cve-2017-17485","url":"https://github.com/x7iaob/cve-2017-17485","stars":0,"created":"2019-04-21"}]},"first":{"date":"2019-04-21","source":"PoC-in-GitHub","url":"https://github.com/x7iaob/cve-2017-17485"},"provenance":"source"},"affected":[{"ecosystem":"Maven","package":"com.fasterxml.jackson.core:jackson-databind","vulnerableRanges":[">=2.9.0, <2.9.4",">=2.8.0, <2.8.11","<2.7.9.2"],"patched":["2.9.4","2.8.11","2.7.9.2"],"from":["GHSA-rfx6-vp9g-rh7v"],"provenance":"source"}],"euvd":{"id":"EUVD-2018-0684","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-fasterxml-jackson-databind-cve-2017-17485","parents":[{"from":"CVE-2017-7525","to":"CVE-2017-17485","relation":"incomplete-fix","confidence":"high","kind":"lineage","orderedBy":"description","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw.","from":"CVE.org","in":"CVE-2017-17485"}]}],"children":[{"from":"CVE-2017-17485","to":"CVE-2018-5968","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"FasterXML jackson-databind through 2.8.11 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 and CVE-2017-17485 deserialization flaws.","from":"CVE.org","in":"CVE-2018-5968"},{"kind":"version-step","provenance":"source","package":"Maven:com.fasterxml.jackson.core:jackson-databind","fromFixed":"2.8.11","toFixed":"2.8.11.1","daysApart":12}]}],"packageHistory":[{"cve":"CVE-2017-7525","published":"2018-02-06","fixed":"2.8.9","kev":false},{"cve":"CVE-2017-15095","published":"2018-02-06","fixed":"2.9.4","kev":false},{"cve":"CVE-2017-17485","published":"2018-01-10","fixed":"2.9.4","kev":false},{"cve":"CVE-2018-5968","published":"2018-01-22","fixed":"2.9.4","kev":false},{"cve":"CVE-2018-7489","published":"2018-02-26","fixed":"2.9.5","kev":false},{"cve":"CVE-2018-11307","published":"2019-07-09","fixed":"2.9.6","kev":false}],"package":"Maven:com.fasterxml.jackson.core:jackson-databind"}}