CVE-2017-7525
15Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackepss 38%
probabilidad de explotación
38%top 2% de las CVE
explotación observada
noninguna fuente lo reporta
A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.
Productos afectados
FasterXML · jackson-databindReferencias
https://access.redhat.com/errata/RHSA-2017:1834https://access.redhat.com/errata/RHSA-2017:1835https://access.redhat.com/errata/RHSA-2017:1836https://access.redhat.com/errata/RHSA-2017:1837https://access.redhat.com/errata/RHSA-2017:1839https://access.redhat.com/errata/RHSA-2017:1840https://access.redhat.com/errata/RHSA-2017:2477https://access.redhat.com/errata/RHSA-2017:2546https://access.redhat.com/errata/RHSA-2017:2547https://access.redhat.com/errata/RHSA-2017:2633https://access.redhat.com/errata/RHSA-2017:2635https://access.redhat.com/errata/RHSA-2017:2636