Read the docs
TI-2017-11069 Aliases CVE-2017-15095GHSA-h592-38cm-4ggp

Deserialization of untrusted data in FasterXML jackson-databind

Priority MEDIUM 60CWE-184Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 20 fixed, 8 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-502.

Summary

A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaw CVE-2017-7525 by blacklisting more classes that could be used maliciously.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.08357 94th percentileScored 2026-11-07
Fix Partial jackson-databind (FasterXML): 2.8.10, 2.9.1com.fasterxml.jackson.core:jackson-databind (Maven): 2.8.11, 2.9.4, 2.6.7.3 +1Red Hat: 18 advisoriesRed Hat: 20 fixed, 8 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
FasterXMLjackson-databindbefore 2.8.10; before 2.9.12.8.10, 2.9.1Patch availableCNA
—com.fasterxml.jackson.core:jackson-databind (Maven)2.8.0 to before 2.8.112.8.11Patch availableGHSA-h592-38cm-4ggp
—com.fasterxml.jackson.core:jackson-databind (Maven)2.9.0 to before 2.9.42.9.4Patch availableGHSA-h592-38cm-4ggp
—com.fasterxml.jackson.core:jackson-databind (Maven)2.0.0 to before 2.6.7.32.6.7.3Patch availableGHSA-h592-38cm-4ggp
—com.fasterxml.jackson.core:jackson-databind (Maven)2.7.0 to before 2.7.9.22.7.9.2Patch availableGHSA-h592-38cm-4ggp
  • jackson-databind VendorFasterXML Affected before 2.8.10; before 2.9.1 Fixed in 2.8.10, 2.9.1 Patch available CNA
  • com.fasterxml.jackson.core:jackson-databind (Maven) Vendor— Affected 2.8.0 to before 2.8.11 Fixed in 2.8.11 Patch available GHSA-h592-38cm-4ggp
  • com.fasterxml.jackson.core:jackson-databind (Maven) Vendor— Affected 2.9.0 to before 2.9.4 Fixed in 2.9.4 Patch available GHSA-h592-38cm-4ggp
  • com.fasterxml.jackson.core:jackson-databind (Maven) Vendor— Affected 2.0.0 to before 2.6.7.3 Fixed in 2.6.7.3 Patch available GHSA-h592-38cm-4ggp
  • com.fasterxml.jackson.core:jackson-databind (Maven) Vendor— Affected 2.7.0 to before 2.7.9.2 Fixed in 2.7.9.2 Patch available GHSA-h592-38cm-4ggp

CPE configurations NVD · 53

CPEVersionsRoleVendor
cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*2.0.0 to before 2.6.7.2; 2.7.0 to before 2.7.9.2; 2.8.0 to before 2.8.10VulnerableFasterXML
cpe:2.3:a:fasterxml:jackson-databind:2.9.0:-:*:*:*:*:*:*2.9.0VulnerableFasterXML
cpe:2.3:a:fasterxml:jackson-databind:2.9.0:prerelease1:*:*:*:*:*:*2.9.0 prerelease1VulnerableFasterXML
cpe:2.3:a:fasterxml:jackson-databind:2.9.0:prerelease2:*:*:*:*:*:*2.9.0 prerelease2VulnerableFasterXML
cpe:2.3:a:fasterxml:jackson-databind:2.9.0:prerelease3:*:*:*:*:*:*2.9.0 prerelease3VulnerableFasterXML
cpe:2.3:a:fasterxml:jackson-databind:2.9.0:prerelease4:*:*:*:*:*:*2.9.0 prerelease4VulnerableFasterXML
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*8.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*9.0VulnerableDebian
cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:*3.11VulnerableRed Hat
cpe:2.3:a:redhat:satellite:6.4:*:*:*:*:*:*:*6.4VulnerableRed Hat
  • cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:* Versions 2.0.0 to before 2.6.7.2; 2.7.0 to before 2.7.9.2; 2.8.0 to before 2.8.10 Vulnerable ·FasterXML
  • cpe:2.3:a:fasterxml:jackson-databind:2.9.0:-:*:*:*:*:*:* Versions 2.9.0 Vulnerable ·FasterXML
  • cpe:2.3:a:fasterxml:jackson-databind:2.9.0:prerelease1:*:*:*:*:*:* Versions 2.9.0 prerelease1 Vulnerable ·FasterXML
  • cpe:2.3:a:fasterxml:jackson-databind:2.9.0:prerelease2:*:*:*:*:*:* Versions 2.9.0 prerelease2 Vulnerable ·FasterXML
  • cpe:2.3:a:fasterxml:jackson-databind:2.9.0:prerelease3:*:*:*:*:*:* Versions 2.9.0 prerelease3 Vulnerable ·FasterXML
  • cpe:2.3:a:fasterxml:jackson-databind:2.9.0:prerelease4:*:*:*:*:*:* Versions 2.9.0 prerelease4 Vulnerable ·FasterXML
  • cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
  • cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:* Versions 3.11 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:satellite:6.4:*:*:*:*:*:*:* Versions 6.4 Vulnerable ·Red Hat
Show 43 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:redhat:satellite_capsule:6.4:*:*:*:*:*:*:*6.4VulnerableRed Hat
cpe:2.3:a:redhat:openshift_container_platform:4.1:*:*:*:*:*:*:*4.1VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*7.0Running onRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.0.0:*:*:*:*:*:*:*6.0.0VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.4.0:*:*:*:*:*:*:*6.4.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:5.0:*:*:*:*:*:*:*5.0Running onRed Hat
cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*6.0Running onRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.1.0:*:*:*:*:*:*:*7.1.0VulnerableRed Hat
cpe:2.3:a:netapp:oncommand_balance:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:oncommand_performance_manager:-:*:*:*:*:linux:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:oncommand_performance_manager:-:*:*:*:*:vmware_vsphere:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:oncommand_shift:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:oracle:banking_platform:2.5.0:*:*:*:*:*:*:*2.5.0VulnerableOracle
cpe:2.3:a:oracle:banking_platform:2.6.0:*:*:*:*:*:*:*2.6.0VulnerableOracle
cpe:2.3:a:oracle:banking_platform:2.6.1:*:*:*:*:*:*:*2.6.1VulnerableOracle
cpe:2.3:a:oracle:banking_platform:2.6.2:*:*:*:*:*:*:*2.6.2VulnerableOracle
cpe:2.3:a:oracle:clusterware:12.1.0.2.0:*:*:*:*:*:*:*12.1.0.2.0VulnerableOracle
cpe:2.3:a:oracle:communications_billing_and_revenue_management:7.5:*:*:*:*:*:*:*7.5VulnerableOracle
cpe:2.3:a:oracle:communications_billing_and_revenue_management:12.0:*:*:*:*:*:*:*12.0VulnerableOracle
cpe:2.3:a:oracle:communications_diameter_signaling_router:*:*:*:*:*:*:*:*before 8.3VulnerableOracle
cpe:2.3:a:oracle:communications_instant_messaging_server:10.0.1.2.0:*:*:*:*:*:*:*10.0.1.2.0VulnerableOracle
cpe:2.3:a:oracle:database_server:12.2.0.1:*:*:*:*:*:*:*12.2.0.1VulnerableOracle
cpe:2.3:a:oracle:database_server:18.1:*:*:*:*:*:*:*18.1VulnerableOracle
cpe:2.3:a:oracle:enterprise_manager_for_virtualization:13.2.2:*:*:*:*:*:*:*13.2.2VulnerableOracle
cpe:2.3:a:oracle:enterprise_manager_for_virtualization:13.2.3:*:*:*:*:*:*:*13.2.3VulnerableOracle
cpe:2.3:a:oracle:enterprise_manager_for_virtualization:13.3.1:*:*:*:*:*:*:*13.3.1VulnerableOracle
cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.2:*:*:*:*:*:*:*8.0.2VulnerableOracle
cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.3:*:*:*:*:*:*:*8.0.3VulnerableOracle
cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.4:*:*:*:*:*:*:*8.0.4VulnerableOracle
cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.5:*:*:*:*:*:*:*8.0.5VulnerableOracle
cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.6:*:*:*:*:*:*:*8.0.6VulnerableOracle
cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.7:*:*:*:*:*:*:*8.0.7VulnerableOracle
cpe:2.3:a:oracle:global_lifecycle_management_opatchauto:*:*:*:*:*:*:*:*before 12.2.0.1.14VulnerableOracle
cpe:2.3:a:oracle:identity_manager:11.1.2.3.0:*:*:*:*:*:*:*11.1.2.3.0VulnerableOracle
cpe:2.3:a:oracle:identity_manager:12.2.1.3.0:*:*:*:*:*:*:*12.2.1.3.0VulnerableOracle
cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:9.2:*:*:*:*:*:*:*9.2VulnerableOracle
cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:*17.1 – 17.12VulnerableOracle
cpe:2.3:a:oracle:primavera_unifier:16.1:*:*:*:*:*:*:*16.1VulnerableOracle
cpe:2.3:a:oracle:primavera_unifier:16.2:*:*:*:*:*:*:*16.2VulnerableOracle
cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:*18.8VulnerableOracle
cpe:2.3:a:oracle:utilities_advanced_spatial_and_operational_analytics:2.7.0.1:*:*:*:*:*:*:*2.7.0.1VulnerableOracle
cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:*12.2.1.3.0VulnerableOracle
  • cpe:2.3:a:redhat:satellite_capsule:6.4:*:*:*:*:*:*:* Versions 6.4 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openshift_container_platform:4.1:*:*:*:*:*:*:* Versions 4.1 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Running on ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.0.0:*:*:*:*:*:*:* Versions 6.0.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.4.0:*:*:*:*:*:*:* Versions 6.4.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:5.0:*:*:*:*:*:*:* Versions 5.0 Running on ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:* Versions 6.0 Running on ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.1.0:*:*:*:*:*:*:* Versions 7.1.0 Vulnerable ·Red Hat
  • cpe:2.3:a:netapp:oncommand_balance:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:oncommand_performance_manager:-:*:*:*:*:linux:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:oncommand_performance_manager:-:*:*:*:*:vmware_vsphere:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:oncommand_shift:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:oracle:banking_platform:2.5.0:*:*:*:*:*:*:* Versions 2.5.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_platform:2.6.0:*:*:*:*:*:*:* Versions 2.6.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_platform:2.6.1:*:*:*:*:*:*:* Versions 2.6.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_platform:2.6.2:*:*:*:*:*:*:* Versions 2.6.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:clusterware:12.1.0.2.0:*:*:*:*:*:*:* Versions 12.1.0.2.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_billing_and_revenue_management:7.5:*:*:*:*:*:*:* Versions 7.5 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_billing_and_revenue_management:12.0:*:*:*:*:*:*:* Versions 12.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_diameter_signaling_router:*:*:*:*:*:*:*:* Versions before 8.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_instant_messaging_server:10.0.1.2.0:*:*:*:*:*:*:* Versions 10.0.1.2.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:database_server:12.2.0.1:*:*:*:*:*:*:* Versions 12.2.0.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:database_server:18.1:*:*:*:*:*:*:* Versions 18.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:enterprise_manager_for_virtualization:13.2.2:*:*:*:*:*:*:* Versions 13.2.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:enterprise_manager_for_virtualization:13.2.3:*:*:*:*:*:*:* Versions 13.2.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:enterprise_manager_for_virtualization:13.3.1:*:*:*:*:*:*:* Versions 13.3.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.2:*:*:*:*:*:*:* Versions 8.0.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.3:*:*:*:*:*:*:* Versions 8.0.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.4:*:*:*:*:*:*:* Versions 8.0.4 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.5:*:*:*:*:*:*:* Versions 8.0.5 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.6:*:*:*:*:*:*:* Versions 8.0.6 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.7:*:*:*:*:*:*:* Versions 8.0.7 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:global_lifecycle_management_opatchauto:*:*:*:*:*:*:*:* Versions before 12.2.0.1.14 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:identity_manager:11.1.2.3.0:*:*:*:*:*:*:* Versions 11.1.2.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:identity_manager:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:9.2:*:*:*:*:*:*:* Versions 9.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:* Versions 17.1 – 17.12 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_unifier:16.1:*:*:*:*:*:*:* Versions 16.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_unifier:16.2:*:*:*:*:*:*:* Versions 16.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:* Versions 18.8 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:utilities_advanced_spatial_and_operational_analytics:2.7.0.1:*:*:*:*:*:*:* Versions 2.7.0.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle

Remediation

  • Fix · CNA jackson-databind (FasterXML) Fixed in 2.8.10, 2.9.1
  • Fix · GHSA-h592-38cm-4ggp com.fasterxml.jackson.core:jackson-databind (Maven) Fixed in 2.8.11 Advisory →
  • Fix · GHSA-h592-38cm-4ggp com.fasterxml.jackson.core:jackson-databind (Maven) Fixed in 2.9.4 Advisory →
  • Fix · GHSA-h592-38cm-4ggp com.fasterxml.jackson.core:jackson-databind (Maven) Fixed in 2.6.7.3 Advisory →
  • Fix · GHSA-h592-38cm-4ggp com.fasterxml.jackson.core:jackson-databind (Maven) Fixed in 2.7.9.2 Advisory →

Red Hat 18 advisories

  • RHSA-2019:3892 Released 2019-11-14 · Red Hat rating Important
    Red Hat Fuse 7.5.0 security update
    • Red Hat Fuse 7.5.0
  • RHSA-2019:3149 Released 2019-10-18 · Red Hat rating Important
    OpenShift Container Platform logging-elasticsearch5-container security update
    • Red Hat OpenShift Container Platform 3.11 openshift3/ose-logging-elasticsearch5
  • RHSA-2019:2858 Released 2019-09-27 · Red Hat rating Important
    OpenShift Container Platform 4.1.18 logging-elasticsearch5 security update
    • Red Hat OpenShift Container Platform 4.1 openshift4/ose-logging-elasticsearch5
Show 15 more Red Hat advisories
  • RHSA-2018:2927 Released 2018-10-16 · Red Hat rating Important
    Satellite 6.4 security, bug fix, and enhancement update
    • Red Hat Satellite 6.4 SOAPpy-0.11.6-17.el7, ansiblerole-insights-client-1.5-1.el7sat, candlepin-2.4.8-1.el7 +47
    • Red Hat Satellite Capsule 6.4 SOAPpy-0.11.6-17.el7, ansiblerole-insights-client-1.5-1.el7sat, createrepo_c-0.7.4-1.el7sat +47
  • RHSA-2018:1451 Released 2018-05-14 · Red Hat rating Important
    eap6-jboss-ec2-eap security update
    • Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server jboss-ec2-eap-7.5.20-1.Final_redhat_1.ep6.el6, jboss-ec2-eap-samples-7.5.20-1.Final_redhat_1.ep6.el6
  • RHSA-2018:1449 Released 2018-05-14 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 6.4.20 security update
    • Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server codehaus-jackson-1.9.9-12.redhat_6.1.ep6.el6, codehaus-jackson-core-asl-1.9.9-12.redhat_6.1.ep6.el6, codehaus-jackson-jaxrs-1.9.9-12.redhat_6.1.ep6.el6 +47
  • RHSA-2018:1450 Released 2018-05-14 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 6.4.20 security update
    • Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 5 Server codehaus-jackson-1.9.9-12.redhat_6.1.ep6.el5, codehaus-jackson-core-asl-1.9.9-12.redhat_6.1.ep6.el5, codehaus-jackson-jaxrs-1.9.9-12.redhat_6.1.ep6.el5 +47
  • RHSA-2018:1448 Released 2018-05-14 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 6.4.20 security update
    • Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 Server codehaus-jackson-1.9.9-12.redhat_6.1.ep6.el7, codehaus-jackson-core-asl-1.9.9-12.redhat_6.1.ep6.el7, codehaus-jackson-jaxrs-1.9.9-12.redhat_6.1.ep6.el7 +47
  • RHSA-2018:1447 Released 2018-05-14 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 6.4.20 security update
    • Red Hat JBoss Enterprise Application Platform 6.4
  • RHSA-2018:0577 Released 2018-03-22 · Red Hat rating Important
    Red Hat JBoss BPM Suite 6.4.9 security update
    • Red Hat JBoss BPMS 6.4
  • RHSA-2018:0576 Released 2018-03-22 · Red Hat rating Important
    Red Hat JBoss BRMS 6.4.9 security update
    • Red Hat JBoss BRMS 6.4
  • RHSA-2018:0481 Released 2018-03-12 · Red Hat rating Important
    jboss-ec2-eap package for EAP 7.1.1
    • Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Server eap7-jboss-ec2-eap-7.1.1-3.1.GA_redhat_3.ep7.el6, eap7-jboss-ec2-eap-samples-7.1.1-3.1.GA_redhat_3.ep7.el6
    • Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Server eap7-jboss-ec2-eap-7.1.1-3.1.GA_redhat_3.ep7.el7, eap7-jboss-ec2-eap-samples-7.1.1-3.1.GA_redhat_3.ep7.el7
  • RHSA-2018:0479 Released 2018-03-12 · Red Hat rating Important
    JBoss Enterprise Application Platform 7.1.1 on RHEL 6
    • Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Server eap7-activemq-artemis-1.5.5.009-1.redhat_1.1.ep7.el6, eap7-activemq-artemis-cli-1.5.5.009-1.redhat_1.1.ep7.el6, eap7-activemq-artemis-commons-1.5.5.009-1.redhat_1.1.ep7.el6 +47
  • RHSA-2018:0480 Released 2018-03-12 · Red Hat rating Important
    JBoss Enterprise Application Platform 7.1.1 for RHEL 7
    • Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Server eap7-activemq-artemis-1.5.5.009-1.redhat_1.1.ep7.el7, eap7-activemq-artemis-cli-1.5.5.009-1.redhat_1.1.ep7.el7, eap7-activemq-artemis-commons-1.5.5.009-1.redhat_1.1.ep7.el7 +47
  • RHSA-2018:0478 Released 2018-03-12 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.1.1 security update
    • Red Hat JBoss EAP 7.1
  • RHSA-2018:0342 Released 2018-02-22 · Red Hat rating Important
    rh-maven35-jackson-databind security update
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-maven35-jackson-databind-2.7.6-2.4.el7, rh-maven35-jackson-databind-javadoc-2.7.6-2.4.el7
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3) rh-maven35-jackson-databind-2.7.6-2.4.el7, rh-maven35-jackson-databind-javadoc-2.7.6-2.4.el7
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4) rh-maven35-jackson-databind-2.7.6-2.4.el7, rh-maven35-jackson-databind-javadoc-2.7.6-2.4.el7
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-maven35-jackson-databind-2.7.6-2.4.el7, rh-maven35-jackson-databind-javadoc-2.7.6-2.4.el7
  • RHSA-2017:3190 Released 2017-11-13 · Red Hat rating Important
    rh-eclipse46-jackson-databind security update
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-eclipse46-jackson-databind-2.6.3-2.4.el7, rh-eclipse46-jackson-databind-javadoc-2.6.3-2.4.el7
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3) rh-eclipse46-jackson-databind-2.6.3-2.4.el7, rh-eclipse46-jackson-databind-javadoc-2.6.3-2.4.el7
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4) rh-eclipse46-jackson-databind-2.6.3-2.4.el7, rh-eclipse46-jackson-databind-javadoc-2.6.3-2.4.el7
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-eclipse46-jackson-databind-2.6.3-2.4.el7, rh-eclipse46-jackson-databind-javadoc-2.6.3-2.4.el7
  • RHSA-2017:3189 Released 2017-11-13 · Red Hat rating Important
    rh-eclipse47-jackson-databind security update
    • Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7) rh-eclipse47-jackson-databind-2.7.6-3.3.el7, rh-eclipse47-jackson-databind-javadoc-2.7.6-3.3.el7
    • Red Hat Developer Tools for Red Hat Enterprise Linux Workstation (v. 7) rh-eclipse47-jackson-databind-2.7.6-3.3.el7, rh-eclipse47-jackson-databind-javadoc-2.7.6-3.3.el7

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Virtualization 3AffectedNo fix planned: Will not fix
Red Hat JBoss Data Virtualization 6AffectedNo fix yet
Red Hat OpenShift Container Platform 3.10AffectedNo fix yet
Red Hat OpenShift Container Platform 3.6AffectedNo fix yet
Red Hat OpenShift Container Platform 3.7AffectedNo fix yet
Red Hat OpenShift Container Platform 3.9AffectedNo fix yet
Red Hat Subscription Asset ManagerAffectedNo fix planned: Will not fix
Red Hat Virtualization 4AffectedNo fix yet
Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2017:3189
Red Hat Developer Tools for Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2017:3189
Red Hat Fuse 7.5.0Fixed RHSA-2019:3892
Red Hat JBoss BPMS 6.4Fixed RHSA-2018:0577
Red Hat JBoss BRMS 6.4Fixed RHSA-2018:0576
Red Hat JBoss EAP 7.1Fixed RHSA-2018:0478
Red Hat JBoss Enterprise Application Platform 6.4Fixed RHSA-2018:1447
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 5 ServerFixed RHSA-2018:1450
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 ServerFixed RHSA-2018:1449, RHSA-2018:1451
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 ServerFixed RHSA-2018:1448
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 ServerFixed RHSA-2018:0479, RHSA-2018:0481
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 ServerFixed RHSA-2018:0480, RHSA-2018:0481
Red Hat OpenShift Container Platform 3.11Fixed RHSA-2019:3149
Red Hat OpenShift Container Platform 4.1Fixed RHSA-2019:2858
Red Hat Satellite 6.4Fixed RHSA-2018:2927
Red Hat Satellite Capsule 6.4Fixed RHSA-2018:2927
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2017:3190, RHSA-2018:0342
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3)Fixed RHSA-2017:3190, RHSA-2018:0342
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4)Fixed RHSA-2017:3190, RHSA-2018:0342
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2017:3190, RHSA-2018:0342
Not affected: 6 products
  • Red Hat JBoss A-MQ 6
  • Red Hat JBoss Data Grid 7
  • Red Hat JBoss Fuse 6
  • Red Hat JBoss Operations Network 3
  • Red Hat Mobile Application Platform 4
  • Red Hat OpenShift Enterprise 2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-15095
  2. 2026-10-03 Alias added: GHSA-h592-38cm-4ggp
  3. 2026-10-08 CISA SSVC decision points changed
  4. 2026-11-05 Fix available: Red Hat JBoss EAP 7.1 · Red Hat

References

Patch 6

Advisory 24

Other 12

  • TI-2017-12774 FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated… CVSS 3.1CRITICAL 9.8
  • TI-2017-05167 Deserialization of untrusted data in FasterXML jackson-databind CVSS 3.1CRITICAL 9.8
  • TI-2020-07095 FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI… CVSS 3.1CRITICAL 9.8
  • TI-2026-39358 jackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiation CVSS 3.1HIGH 8.1
  • TI-2020-08560 A deserialization flaw was discovered in jackson-databind through 2.9.10.4. CVSS 3.1HIGH 8.1
  • TI-2020-07635 FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between… CVSS 3.1CRITICAL 9.8
See all 77 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences