Read the docs
TI-2017-05167 Aliases CVE-2017-7525GHSA-qxxx-2pp7-5hmx

Deserialization of untrusted data in FasterXML jackson-databind

Priority HIGH 75CWE-184Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 26 fixed, 12 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-502.

Summary

A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.37721 98th percentileScored 2026-11-07
Fix Partial jackson-databind (FasterXML): 2.6.7.1, 2.7.9.1, 2.8.9com.fasterxml.jackson.core:jackson-databind (Maven): 2.6.7.1, 2.7.9.1, 2.8.9Red Hat: 26 advisoriesRed Hat: 26 fixed, 12 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
FasterXMLjackson-databindbefore 2.6.7.1; before 2.7.9.1; before 2.8.92.6.7.1, 2.7.9.1, 2.8.9Patch availableCNA
—com.fasterxml.jackson.core:jackson-databind (Maven)before 2.6.7.12.6.7.1Patch availableGHSA-qxxx-2pp7-5hmx
—com.fasterxml.jackson.core:jackson-databind (Maven)2.7.0 to before 2.7.9.12.7.9.1Patch availableGHSA-qxxx-2pp7-5hmx
—com.fasterxml.jackson.core:jackson-databind (Maven)2.8.0 to before 2.8.92.8.9Patch availableGHSA-qxxx-2pp7-5hmx
  • jackson-databind VendorFasterXML Affected before 2.6.7.1; before 2.7.9.1; before 2.8.9 Fixed in 2.6.7.1, 2.7.9.1, 2.8.9 Patch available CNA
  • com.fasterxml.jackson.core:jackson-databind (Maven) Vendor— Affected before 2.6.7.1 Fixed in 2.6.7.1 Patch available GHSA-qxxx-2pp7-5hmx
  • com.fasterxml.jackson.core:jackson-databind (Maven) Vendor— Affected 2.7.0 to before 2.7.9.1 Fixed in 2.7.9.1 Patch available GHSA-qxxx-2pp7-5hmx
  • com.fasterxml.jackson.core:jackson-databind (Maven) Vendor— Affected 2.8.0 to before 2.8.9 Fixed in 2.8.9 Patch available GHSA-qxxx-2pp7-5hmx

CPE configurations NVD · 47

CPEVersionsRoleVendor
cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*before 2.6.7.1; 2.7.0 to before 2.7.9.1; 2.8.0 to before 2.8.9VulnerableFasterXML
cpe:2.3:a:fasterxml:jackson-databind:2.9.0:prerelease1:*:*:*:*:*:*2.9.0 prerelease1VulnerableFasterXML
cpe:2.3:a:fasterxml:jackson-databind:2.9.0:prerelease2:*:*:*:*:*:*2.9.0 prerelease2VulnerableFasterXML
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*8.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*9.0VulnerableDebian
cpe:2.3:a:netapp:oncommand_balance:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:oncommand_performance_manager:-:*:*:*:*:linux:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:oncommand_performance_manager:-:*:*:*:*:vmware_vsphere:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:oncommand_shift:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
  • cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:* Versions before 2.6.7.1; 2.7.0 to before 2.7.9.1; 2.8.0 to before 2.8.9 Vulnerable ·FasterXML
  • cpe:2.3:a:fasterxml:jackson-databind:2.9.0:prerelease1:*:*:*:*:*:* Versions 2.9.0 prerelease1 Vulnerable ·FasterXML
  • cpe:2.3:a:fasterxml:jackson-databind:2.9.0:prerelease2:*:*:*:*:*:* Versions 2.9.0 prerelease2 Vulnerable ·FasterXML
  • cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
  • cpe:2.3:a:netapp:oncommand_balance:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:oncommand_performance_manager:-:*:*:*:*:linux:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:oncommand_performance_manager:-:*:*:*:*:vmware_vsphere:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:oncommand_shift:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
Show 37 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:redhat:openshift_container_platform:4.1:*:*:*:*:*:*:*4.1VulnerableRed Hat
cpe:2.3:a:redhat:virtualization:4.0:*:*:*:*:*:*:*4.0VulnerableRed Hat
cpe:2.3:a:redhat:virtualization_host:4.0:*:*:*:*:*:*:*4.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*7.0Running onRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.0.0:*:*:*:*:*:*:*6.0.0VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.4.0:*:*:*:*:*:*:*6.4.0VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.1:*:*:*:*:*:*:*7.1VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*6.0Running onRed Hat
cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:*5.0Running onRed Hat
cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:*3.11VulnerableRed Hat
cpe:2.3:a:oracle:banking_platform:2.5.0:*:*:*:*:*:*:*2.5.0VulnerableOracle
cpe:2.3:a:oracle:banking_platform:2.6.0:*:*:*:*:*:*:*2.6.0VulnerableOracle
cpe:2.3:a:oracle:banking_platform:2.6.1:*:*:*:*:*:*:*2.6.1VulnerableOracle
cpe:2.3:a:oracle:banking_platform:2.6.2:*:*:*:*:*:*:*2.6.2VulnerableOracle
cpe:2.3:a:oracle:communications_billing_and_revenue_management:7.5:*:*:*:*:*:*:*7.5VulnerableOracle
cpe:2.3:a:oracle:communications_billing_and_revenue_management:12.0:*:*:*:*:*:*:*12.0VulnerableOracle
cpe:2.3:a:oracle:communications_communications_policy_management:*:*:*:*:*:*:*:*12.0 – 12.5.2VulnerableOracle
cpe:2.3:a:oracle:communications_diameter_signaling_route:*:*:*:*:*:*:*:*before 8.3VulnerableOracle
cpe:2.3:a:oracle:communications_instant_messaging_server:10.0.1:*:*:*:*:*:*:*10.0.1VulnerableOracle
cpe:2.3:a:oracle:communications_instant_messaging_server:10.0.1.2.0:*:*:*:*:*:*:*10.0.1.2.0VulnerableOracle
cpe:2.3:a:oracle:enterprise_manager_for_virtualization:13.2.2:*:*:*:*:*:*:*13.2.2VulnerableOracle
cpe:2.3:a:oracle:enterprise_manager_for_virtualization:13.2.3:*:*:*:*:*:*:*13.2.3VulnerableOracle
cpe:2.3:a:oracle:enterprise_manager_for_virtualization:13.3.1:*:*:*:*:*:*:*13.3.1VulnerableOracle
cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.2.0.0:*:*:*:*:*:*:*8.0.2.0.0VulnerableOracle
cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.3.0.0:*:*:*:*:*:*:*8.0.3.0.0VulnerableOracle
cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.4.0.0:*:*:*:*:*:*:*8.0.4.0.0VulnerableOracle
cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.5.0.0:*:*:*:*:*:*:*8.0.5.0.0VulnerableOracle
cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.6.0.0:*:*:*:*:*:*:*8.0.6.0.0VulnerableOracle
cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.7.0.0:*:*:*:*:*:*:*8.0.7.0.0VulnerableOracle
cpe:2.3:a:oracle:global_lifecycle_management_opatchauto:*:*:*:*:*:*:*:*before 12.2.0.1.14VulnerableOracle
cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:*17.1 – 17.12VulnerableOracle
cpe:2.3:a:oracle:primavera_unifier:16.1:*:*:*:*:*:*:*16.1VulnerableOracle
cpe:2.3:a:oracle:primavera_unifier:16.2:*:*:*:*:*:*:*16.2VulnerableOracle
cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:*18.8VulnerableOracle
cpe:2.3:a:oracle:utilities_advanced_spatial_and_operational_analytics:2.7.0.1:*:*:*:*:*:*:*2.7.0.1VulnerableOracle
cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:*12.2.1.3.0VulnerableOracle
  • cpe:2.3:a:redhat:openshift_container_platform:4.1:*:*:*:*:*:*:* Versions 4.1 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:virtualization:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:virtualization_host:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:* Versions 7.0 Running on ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.0.0:*:*:*:*:*:*:* Versions 6.0.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.4.0:*:*:*:*:*:*:* Versions 6.4.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.1:*:*:*:*:*:*:* Versions 7.1 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:* Versions 6.0 Running on ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:* Versions 5.0 Running on ·Red Hat
  • cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:* Versions 3.11 Vulnerable ·Red Hat
  • cpe:2.3:a:oracle:banking_platform:2.5.0:*:*:*:*:*:*:* Versions 2.5.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_platform:2.6.0:*:*:*:*:*:*:* Versions 2.6.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_platform:2.6.1:*:*:*:*:*:*:* Versions 2.6.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_platform:2.6.2:*:*:*:*:*:*:* Versions 2.6.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_billing_and_revenue_management:7.5:*:*:*:*:*:*:* Versions 7.5 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_billing_and_revenue_management:12.0:*:*:*:*:*:*:* Versions 12.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_communications_policy_management:*:*:*:*:*:*:*:* Versions 12.0 – 12.5.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_diameter_signaling_route:*:*:*:*:*:*:*:* Versions before 8.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_instant_messaging_server:10.0.1:*:*:*:*:*:*:* Versions 10.0.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_instant_messaging_server:10.0.1.2.0:*:*:*:*:*:*:* Versions 10.0.1.2.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:enterprise_manager_for_virtualization:13.2.2:*:*:*:*:*:*:* Versions 13.2.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:enterprise_manager_for_virtualization:13.2.3:*:*:*:*:*:*:* Versions 13.2.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:enterprise_manager_for_virtualization:13.3.1:*:*:*:*:*:*:* Versions 13.3.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.2.0.0:*:*:*:*:*:*:* Versions 8.0.2.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.3.0.0:*:*:*:*:*:*:* Versions 8.0.3.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.4.0.0:*:*:*:*:*:*:* Versions 8.0.4.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.5.0.0:*:*:*:*:*:*:* Versions 8.0.5.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.6.0.0:*:*:*:*:*:*:* Versions 8.0.6.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.7.0.0:*:*:*:*:*:*:* Versions 8.0.7.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:global_lifecycle_management_opatchauto:*:*:*:*:*:*:*:* Versions before 12.2.0.1.14 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:* Versions 17.1 – 17.12 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_unifier:16.1:*:*:*:*:*:*:* Versions 16.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_unifier:16.2:*:*:*:*:*:*:* Versions 16.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:* Versions 18.8 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:utilities_advanced_spatial_and_operational_analytics:2.7.0.1:*:*:*:*:*:*:* Versions 2.7.0.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle

Remediation

  • Fix · CNA jackson-databind (FasterXML) Fixed in 2.6.7.1, 2.7.9.1, 2.8.9
  • Fix · GHSA-qxxx-2pp7-5hmx com.fasterxml.jackson.core:jackson-databind (Maven) Fixed in 2.6.7.1 Advisory →
  • Fix · GHSA-qxxx-2pp7-5hmx com.fasterxml.jackson.core:jackson-databind (Maven) Fixed in 2.7.9.1 Advisory →
  • Fix · GHSA-qxxx-2pp7-5hmx com.fasterxml.jackson.core:jackson-databind (Maven) Fixed in 2.8.9 Advisory →

Red Hat 26 advisories

  • RHSA-2019:3149 Released 2019-10-18 · Red Hat rating Important
    OpenShift Container Platform logging-elasticsearch5-container security update
    • Red Hat OpenShift Container Platform 3.11 openshift3/ose-logging-elasticsearch5
  • RHSA-2019:2858 Released 2019-09-27 · Red Hat rating Important
    OpenShift Container Platform 4.1.18 logging-elasticsearch5 security update
    • Red Hat OpenShift Container Platform 4.1 openshift4/ose-logging-elasticsearch5
  • RHSA-2019:0910 Released 2019-04-30 · Red Hat rating Important
    Red Hat Fuse 7.3 security update
    • Red Hat Fuse 7.3
Show 23 more Red Hat advisories
  • RHSA-2018:1449 Released 2018-05-14 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 6.4.20 security update
    • Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server codehaus-jackson-1.9.9-12.redhat_6.1.ep6.el6, codehaus-jackson-core-asl-1.9.9-12.redhat_6.1.ep6.el6, codehaus-jackson-jaxrs-1.9.9-12.redhat_6.1.ep6.el6 +47
  • RHSA-2018:1450 Released 2018-05-14 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 6.4.20 security update
    • Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 5 Server codehaus-jackson-1.9.9-12.redhat_6.1.ep6.el5, codehaus-jackson-core-asl-1.9.9-12.redhat_6.1.ep6.el5, codehaus-jackson-jaxrs-1.9.9-12.redhat_6.1.ep6.el5 +47
  • RHSA-2018:0342 Released 2018-02-22 · Red Hat rating Important
    rh-maven35-jackson-databind security update
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-maven35-jackson-databind-2.7.6-2.4.el7, rh-maven35-jackson-databind-javadoc-2.7.6-2.4.el7
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3) rh-maven35-jackson-databind-2.7.6-2.4.el7, rh-maven35-jackson-databind-javadoc-2.7.6-2.4.el7
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4) rh-maven35-jackson-databind-2.7.6-2.4.el7, rh-maven35-jackson-databind-javadoc-2.7.6-2.4.el7
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-maven35-jackson-databind-2.7.6-2.4.el7, rh-maven35-jackson-databind-javadoc-2.7.6-2.4.el7
  • RHSA-2018:0294 Released 2018-02-12 · Red Hat rating Important
    Red Hat JBoss Data Grid 7.1.2 security update
    • Red Hat Data Grid 7.1.2
  • RHSA-2017:3458 Released 2017-12-13 · Red Hat rating Important
    eap7-jboss-ec2-eap security update
    • Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Server eap7-jboss-ec2-eap-7.1.0-5.GA_redhat_5.ep7.el6, eap7-jboss-ec2-eap-samples-7.1.0-5.GA_redhat_5.ep7.el6
    • Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Server eap7-jboss-ec2-eap-7.1.0-5.GA_redhat_5.ep7.el7, eap7-jboss-ec2-eap-samples-7.1.0-5.GA_redhat_5.ep7.el7
  • RHSA-2017:3455 Released 2017-12-13 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.1.0 security update
    • Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Server eap7-activemq-artemis-1.5.5.008-1.redhat_1.1.ep7.el7, eap7-activemq-artemis-cli-1.5.5.008-1.redhat_1.1.ep7.el7, eap7-activemq-artemis-commons-1.5.5.008-1.redhat_1.1.ep7.el7 +47
  • RHSA-2017:3454 Released 2017-12-13 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.1.0 security update
    • Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Server eap7-activemq-artemis-1.5.5.008-1.redhat_1.1.ep7.el6, eap7-activemq-artemis-cli-1.5.5.008-1.redhat_1.1.ep7.el6, eap7-activemq-artemis-commons-1.5.5.008-1.redhat_1.1.ep7.el6 +47
  • RHSA-2017:3456 Released 2017-12-13 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.1.0 security update
    • Red Hat JBoss EAP 7.1
  • RHSA-2017:3141 Released 2017-11-07 · Red Hat rating Important
    rhvm-appliance security, bug fix, and enhancement update
    • Red Hat Virtualization 4 Hypervisor for RHEL 7 rhvm-appliance-1:4.1.20171102.0-1.el7
    • Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts rhvm-appliance-1:4.1.20171102.0-1.el7
  • RHSA-2017:2638 Released 2017-09-05 · Red Hat rating Important
    jboss-ec2-eap security, bug fix, and enhancement update
    • Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server jboss-ec2-eap-7.5.17-1.Final_redhat_4.ep6.el6, jboss-ec2-eap-samples-7.5.17-1.Final_redhat_4.ep6.el6
  • RHSA-2017:2635 Released 2017-09-05 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 6.4.17 update on RHEL 6
    • Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server apache-cxf-2.7.18-7.SP6_redhat_1.1.ep6.el6, codehaus-jackson-1.9.9-11.redhat_5.1.ep6.el6, codehaus-jackson-core-asl-1.9.9-11.redhat_5.1.ep6.el6 +47
  • RHSA-2017:2637 Released 2017-09-05 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 6.4.17 update on RHEL 5
    • Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 5 Server apache-cxf-2.7.18-7.SP6_redhat_1.1.ep6.el5, codehaus-jackson-1.9.9-11.redhat_5.1.ep6.el5, codehaus-jackson-core-asl-1.9.9-11.redhat_5.1.ep6.el5 +47
  • RHSA-2017:2636 Released 2017-09-05 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 6.4.17 update on RHEL 7
    • Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 Server apache-cxf-2.7.18-7.SP6_redhat_1.1.ep6.el7, codehaus-jackson-1.9.9-11.redhat_5.1.ep6.el7, codehaus-jackson-core-asl-1.9.9-11.redhat_5.1.ep6.el7 +47
  • RHSA-2017:2633 Released 2017-09-05 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 6.4.17 update
    • Red Hat JBoss Enterprise Application Platform 6.4
  • RHSA-2017:2546 Released 2017-08-29 · Red Hat rating Important
    Red Hat JBoss BPM Suite 6.4.5 security update
    • Red Hat JBoss BPMS 6.4
  • RHSA-2017:2547 Released 2017-08-29 · Red Hat rating Important
    Red Hat JBoss BRMS 6.4.5 security update
    • Red Hat JBoss BRMS 6.4
  • RHSA-2017:2477 Released 2017-08-15 · Red Hat rating Important
    Red Hat JBoss Data Virtualization 6.3 Update 7 security update
    • Red Hat JBoss Data Virtualization 6.3
  • RHSA-2017:1840 Released 2017-07-31 · Red Hat rating Important
    devtoolset-4-jackson-databind security update
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) devtoolset-4-jackson-databind-2.5.0-2.4.el6, devtoolset-4-jackson-databind-javadoc-2.5.0-2.4.el6
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) devtoolset-4-jackson-databind-2.5.0-2.4.el7, devtoolset-4-jackson-databind-javadoc-2.5.0-2.4.el7
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7) devtoolset-4-jackson-databind-2.5.0-2.4.el6, devtoolset-4-jackson-databind-javadoc-2.5.0-2.4.el6
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3) devtoolset-4-jackson-databind-2.5.0-2.4.el7, devtoolset-4-jackson-databind-javadoc-2.5.0-2.4.el7
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) devtoolset-4-jackson-databind-2.5.0-2.4.el6, devtoolset-4-jackson-databind-javadoc-2.5.0-2.4.el6
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) devtoolset-4-jackson-databind-2.5.0-2.4.el7, devtoolset-4-jackson-databind-javadoc-2.5.0-2.4.el7
  • RHSA-2017:1839 Released 2017-07-31 · Red Hat rating Important
    rh-eclipse46-jackson-databind security update
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-eclipse46-jackson-databind-2.6.3-2.3.el7, rh-eclipse46-jackson-databind-javadoc-2.6.3-2.3.el7
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3) rh-eclipse46-jackson-databind-2.6.3-2.3.el7, rh-eclipse46-jackson-databind-javadoc-2.6.3-2.3.el7
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-eclipse46-jackson-databind-2.6.3-2.3.el7, rh-eclipse46-jackson-databind-javadoc-2.6.3-2.3.el7
  • RHSA-2017:1837 Released 2017-07-31 · Red Hat rating Important
    eap7-jboss-ec2-eap security update
    • Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 6 Server eap7-jboss-ec2-eap-7.0.7-1.GA_redhat_1.ep7.el6, eap7-jboss-ec2-eap-samples-7.0.7-1.GA_redhat_1.ep7.el6
    • Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7 Server eap7-jboss-ec2-eap-7.0.7-1.GA_redhat_1.ep7.el7, eap7-jboss-ec2-eap-samples-7.0.7-1.GA_redhat_1.ep7.el7
  • RHSA-2017:1834 Released 2017-07-31 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.0.7 on RHEL 6
    • Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 6 Server eap7-activemq-artemis-1.1.0-18.SP21_redhat_1.1.ep7.el6, eap7-activemq-artemis-cli-1.1.0-18.SP21_redhat_1.1.ep7.el6, eap7-activemq-artemis-commons-1.1.0-18.SP21_redhat_1.1.ep7.el6 +47
  • RHSA-2017:1835 Released 2017-07-31 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.0.7 on RHEL 7
    • Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7 Server eap7-activemq-artemis-1.1.0-18.SP21_redhat_1.1.ep7.el7, eap7-activemq-artemis-cli-1.1.0-18.SP21_redhat_1.1.ep7.el7, eap7-activemq-artemis-commons-1.1.0-18.SP21_redhat_1.1.ep7.el7 +47
  • RHSA-2017:1836 Released 2017-07-31 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.0.7
    • Red Hat JBoss EAP 7.0

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Virtualization 3AffectedNo fix planned: Will not fix
Red Hat JBoss A-MQ 6AffectedNo fix yet
Red Hat JBoss BRMS 6AffectedNo fix yet
Red Hat JBoss Data Grid 7AffectedNo fix yet
Red Hat JBoss Fuse 6AffectedNo fix planned: Will not fix
Red Hat OpenShift Container Platform 3.10AffectedNo fix yet
Red Hat OpenShift Container Platform 3.6AffectedNo fix yet
Red Hat OpenShift Container Platform 3.7AffectedNo fix yet
Red Hat OpenShift Container Platform 3.9AffectedNo fix yet
Red Hat OpenShift Enterprise 2AffectedNo fix planned: Will not fix
Red Hat Satellite 6AffectedNo fix yet
Red Hat Subscription Asset ManagerAffectedNo fix planned: Will not fix
Red Hat Data Grid 7.1.2Fixed RHSA-2018:0294
Red Hat Fuse 7.3Fixed RHSA-2019:0910
Red Hat JBoss BPMS 6.4Fixed RHSA-2017:2546
Red Hat JBoss BRMS 6.4Fixed RHSA-2017:2547
Red Hat JBoss Data Virtualization 6.3Fixed RHSA-2017:2477
Red Hat JBoss EAP 7.0Fixed RHSA-2017:1836
Red Hat JBoss EAP 7.1Fixed RHSA-2017:3456
Red Hat JBoss Enterprise Application Platform 6.4Fixed RHSA-2017:2633
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 5 ServerFixed RHSA-2017:2637, RHSA-2018:1450
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 ServerFixed RHSA-2017:2635, RHSA-2017:2638, RHSA-2018:1449
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 ServerFixed RHSA-2017:2636
Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 6 ServerFixed RHSA-2017:1834, RHSA-2017:1837
Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7 ServerFixed RHSA-2017:1835, RHSA-2017:1837
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 ServerFixed RHSA-2017:3454, RHSA-2017:3458
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 ServerFixed RHSA-2017:3455, RHSA-2017:3458
Red Hat OpenShift Container Platform 3.11Fixed RHSA-2019:3149
Red Hat OpenShift Container Platform 4.1Fixed RHSA-2019:2858
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)Fixed RHSA-2017:1840
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2017:1839, RHSA-2017:1840, RHSA-2018:0342
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)Fixed RHSA-2017:1840
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3)Fixed RHSA-2017:1839, RHSA-2017:1840, RHSA-2018:0342
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4)Fixed RHSA-2018:0342
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)Fixed RHSA-2017:1840
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2017:1839, RHSA-2017:1840, RHSA-2018:0342
Red Hat Virtualization 4 Hypervisor for RHEL 7Fixed RHSA-2017:3141
Red Hat Virtualization 4 Management Agent for RHEL 7 HostsFixed RHSA-2017:3141
Not affected: 3 products
  • Red Hat JBoss Operations Network 3
  • Red Hat Mobile Application Platform 4
  • Red Hat OpenShift Application Runtimes

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-7525
  2. 2026-10-03 Alias added: GHSA-qxxx-2pp7-5hmx
  3. 2026-10-08 CISA SSVC decision points changed
  4. 2026-11-05 Fix available: Red Hat JBoss EAP 7.0, Red Hat JBoss EAP 7.1 · Red Hat

References

Patch 7

Advisory 37

Other 37

  • TI-2017-12774 FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated… CVSS 3.1CRITICAL 9.8
  • TI-2020-07095 FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI… CVSS 3.1CRITICAL 9.8
  • TI-2026-39358 jackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiation CVSS 3.1HIGH 8.1
  • TI-2020-08560 A deserialization flaw was discovered in jackson-databind through 2.9.10.4. CVSS 3.1HIGH 8.1
  • TI-2020-07635 FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between… CVSS 3.1CRITICAL 9.8
  • TI-2018-05398 FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x before 2.9.5… CVSS 3.0CRITICAL 9.8
See all 77 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences