CVE-2017-7525
15Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackepss 38%
probabilidade de exploração
38%top 2% das CVEs
exploração observada
nãonenhuma fonte reporta
A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.
Produtos afetados
FasterXML · jackson-databindReferências
https://access.redhat.com/errata/RHSA-2017:1834https://access.redhat.com/errata/RHSA-2017:1835https://access.redhat.com/errata/RHSA-2017:1836https://access.redhat.com/errata/RHSA-2017:1837https://access.redhat.com/errata/RHSA-2017:1839https://access.redhat.com/errata/RHSA-2017:1840https://access.redhat.com/errata/RHSA-2017:2477https://access.redhat.com/errata/RHSA-2017:2546https://access.redhat.com/errata/RHSA-2017:2547https://access.redhat.com/errata/RHSA-2017:2633https://access.redhat.com/errata/RHSA-2017:2635https://access.redhat.com/errata/RHSA-2017:2636