Read the docs
TI-2017-03118 Aliases CVE-2017-4995GHSA-vhrg-v3cv-p247

Deserialization of untrusted data in Spring Security Spring Security 4.2.0.RELEASE…

Priority MEDIUM 40CWE-502Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 1 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-502.

Summary

An issue was discovered in Pivotal Spring Security 4.2.0.RELEASE through 4.2.2.RELEASE, and Spring Security 5.0.0.M1. When configured to enable default typing, Jackson contained a deserialization vulnerability that could lead to arbitrary code execution. Jackson fixed this vulnerability by blacklisting known "deserialization gadgets." Spring Security configures Jackson with global default typing enabled, which means that (through the previous exploit) arbitrary code could be executed if all of the following is true: (1) Spring Security's Jackson support is being leveraged by invoking SecurityJackson2Modules.getModules(ClassLoader) or SecurityJackson2Modules.enableDefaultTyping(ObjectMapper); (2) Jackson is used to deserialize data that is not trusted (Spring Security does not perform deserialization using Jackson, so this is an explicit choice of the user); and (3) there is an unknown (Jackson is not blacklisting it already) "deserialization gadget" that allows code execution present on the classpath. Jackson provides a blacklisting approach to protecting against this type of attack, but Spring Security should be proactive against blocking unknown "deserialization gadgets" when Spring Security enables default typing.

Why it matters now

EPSS 0.02547 85th percentileScored 2026-11-07
Fix Partial org.springframework.security:spring-security-core (Maven): 4.2.3.RELEASE, 5.0.0.M2Red Hat: 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Spring Security Spring Security 4.2.0.RELEASE 4.2.2.RELEASE and Spring Security 5.0.0.M1Spring Security Spring Security 4.2.0.RELEASE 4.2.2.RELEASE and Spring Security 5.0.0.M1—No fix listedCNA
—org.springframework.security:spring-security-core (Maven)4.2.0.RELEASE to before 4.2.3.RELEASE4.2.3.RELEASEPatch availableGHSA-vhrg-v3cv-p247
—org.springframework.security:spring-security-core (Maven)5.0.0.M1 to before 5.0.0.M25.0.0.M2Patch availableGHSA-vhrg-v3cv-p247
  • Spring Security Spring Security 4.2.0.RELEASE 4.2.2.RELEASE and Spring Security 5.0.0.M1 Vendor— Affected Spring Security Spring Security 4.2.0.RELEASE 4.2.2.RELEASE and Spring Security 5.0.0.M1 Fixed in — No fix listed CNA
  • org.springframework.security:spring-security-core (Maven) Vendor— Affected 4.2.0.RELEASE to before 4.2.3.RELEASE Fixed in 4.2.3.RELEASE Patch available GHSA-vhrg-v3cv-p247
  • org.springframework.security:spring-security-core (Maven) Vendor— Affected 5.0.0.M1 to before 5.0.0.M2 Fixed in 5.0.0.M2 Patch available GHSA-vhrg-v3cv-p247

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:a:vmware:spring_security:4.2.0:release:*:*:*:*:*:*4.2.0 releaseVulnerableVMware
cpe:2.3:a:vmware:spring_security:4.2.1:release:*:*:*:*:*:*4.2.1 releaseVulnerableVMware
cpe:2.3:a:vmware:spring_security:4.2.2:release:*:*:*:*:*:*4.2.2 releaseVulnerableVMware
cpe:2.3:a:vmware:spring_security:5.0.0:m1:*:*:*:*:*:*5.0.0 m1VulnerableVMware
  • cpe:2.3:a:vmware:spring_security:4.2.0:release:*:*:*:*:*:* Versions 4.2.0 release Vulnerable ·VMware
  • cpe:2.3:a:vmware:spring_security:4.2.1:release:*:*:*:*:*:* Versions 4.2.1 release Vulnerable ·VMware
  • cpe:2.3:a:vmware:spring_security:4.2.2:release:*:*:*:*:*:* Versions 4.2.2 release Vulnerable ·VMware
  • cpe:2.3:a:vmware:spring_security:5.0.0:m1:*:*:*:*:*:* Versions 5.0.0 m1 Vulnerable ·VMware

Remediation

  • Fix · GHSA-vhrg-v3cv-p247 org.springframework.security:spring-security-core (Maven) Fixed in 4.2.3.RELEASE Advisory →
  • Fix · GHSA-vhrg-v3cv-p247 org.springframework.security:spring-security-core (Maven) Fixed in 5.0.0.M2 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenStack Platform 10 (Newton)AffectedNo fix planned: Out of support scope
Not affected: 2 products
  • Red Hat JBoss Fuse 6
  • Red Hat OpenStack Platform 13 (Queens)

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-4995
  2. 2026-10-03 Alias added: GHSA-vhrg-v3cv-p247

References

Advisory 2

Other 10

  • TI-2023-16900 Improper access control in Spring Security CVSS 3.1CRITICAL 9.8
  • TI-2022-13611 Authorization bypass in Spring by VMware CVSS 3.1CRITICAL 9.8
  • TI-2022-07154 Incorrect authorization in Spring Security CVSS 3.1CRITICAL 9.8
  • TI-2026-42404 Spring Security embedded UnboundID LDAP server exposes well-known administrative bind DN on all network interfaces CVSS 3.1CRITICAL 9.4
  • TI-2026-18257 Under Some Conditions Spring Security HTTP Headers Are not Written CVSS 3.1CRITICAL 9.1
  • TI-2014-02853 Improper authentication in Pivotal Spring Security CVSS 3.0CRITICAL 9.8
See all 43 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences