CVE-2017-7525 (CNNVD-201707-1181)

CRITICAL
中文标题:
FasterXML Jackson 代码问题漏洞
英文标题:
A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and ...
CVSS分数: 9.8
发布时间: 2018-02-06 15:00:00
漏洞类型: 代码问题
状态: PUBLISHED
数据质量分数: 0.30
数据版本: v3
漏洞描述
中文描述:

FasterXML Jackson是美国FasterXML公司的一款适用于Java的数据处理工具。jackson-databind是其中的一个具有数据绑定功能的组件。 FasterXML jackson-databind 2.6.7.1之前版本、2.7.9.1版本和2.8.9版本中存在代码问题漏洞。该漏洞源于网络系统或产品的代码开发过程中存在设计或实现不当的问题。

英文描述:

A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.

CWE类型:
CWE-502 CWE-184
标签:
（暂无数据）
受影响产品
厂商 产品 版本 版本范围 平台 CPE
FasterXML jackson-databind before 2.6.7.1 - - cpe:2.3:a:fasterxml:jackson-databind:before_2.6.7.1:*:*:*:*:*:*:*
FasterXML jackson-databind before 2.7.9.1 - - cpe:2.3:a:fasterxml:jackson-databind:before_2.7.9.1:*:*:*:*:*:*:*
FasterXML jackson-databind before 2.8.9 - - cpe:2.3:a:fasterxml:jackson-databind:before_2.8.9:*:*:*:*:*:*:*
fasterxml jackson-databind * - - cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*
fasterxml jackson-databind 2.9.0 - - cpe:2.3:a:fasterxml:jackson-databind:2.9.0:prerelease1:*:*:*:*:*:*
debian debian_linux 8.0 - - cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
debian debian_linux 9.0 - - cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
netapp oncommand_balance - - - cpe:2.3:a:netapp:oncommand_balance:-:*:*:*:*:*:*:*
netapp oncommand_performance_manager - - - cpe:2.3:a:netapp:oncommand_performance_manager:-:*:*:*:*:linux:*:*
netapp oncommand_shift - - - cpe:2.3:a:netapp:oncommand_shift:-:*:*:*:*:*:*:*
netapp snapcenter - - - cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:*
redhat openshift_container_platform 4.1 - - cpe:2.3:a:redhat:openshift_container_platform:4.1:*:*:*:*:*:*:*
redhat virtualization 4.0 - - cpe:2.3:a:redhat:virtualization:4.0:*:*:*:*:*:*:*
redhat virtualization_host 4.0 - - cpe:2.3:a:redhat:virtualization_host:4.0:*:*:*:*:*:*:*
redhat jboss_enterprise_application_platform 6.0.0 - - cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.0.0:*:*:*:*:*:*:*
redhat jboss_enterprise_application_platform 6.4.0 - - cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.4.0:*:*:*:*:*:*:*
redhat jboss_enterprise_application_platform 7.0 - - cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0:*:*:*:*:*:*:*
redhat jboss_enterprise_application_platform 7.1 - - cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.1:*:*:*:*:*:*:*
redhat openshift_container_platform 3.11 - - cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:*
oracle banking_platform 2.5.0 - - cpe:2.3:a:oracle:banking_platform:2.5.0:*:*:*:*:*:*:*
oracle banking_platform 2.6.0 - - cpe:2.3:a:oracle:banking_platform:2.6.0:*:*:*:*:*:*:*
oracle banking_platform 2.6.1 - - cpe:2.3:a:oracle:banking_platform:2.6.1:*:*:*:*:*:*:*
oracle banking_platform 2.6.2 - - cpe:2.3:a:oracle:banking_platform:2.6.2:*:*:*:*:*:*:*
oracle communications_billing_and_revenue_management 7.5 - - cpe:2.3:a:oracle:communications_billing_and_revenue_management:7.5:*:*:*:*:*:*:*
oracle communications_billing_and_revenue_management 12.0 - - cpe:2.3:a:oracle:communications_billing_and_revenue_management:12.0:*:*:*:*:*:*:*
oracle communications_communications_policy_management * - - cpe:2.3:a:oracle:communications_communications_policy_management:*:*:*:*:*:*:*:*
oracle communications_diameter_signaling_route * - - cpe:2.3:a:oracle:communications_diameter_signaling_route:*:*:*:*:*:*:*:*
oracle communications_instant_messaging_server 10.0.1 - - cpe:2.3:a:oracle:communications_instant_messaging_server:10.0.1:*:*:*:*:*:*:*
oracle communications_instant_messaging_server 10.0.1.2.0 - - cpe:2.3:a:oracle:communications_instant_messaging_server:10.0.1.2.0:*:*:*:*:*:*:*
oracle enterprise_manager_for_virtualization 13.2.2 - - cpe:2.3:a:oracle:enterprise_manager_for_virtualization:13.2.2:*:*:*:*:*:*:*
oracle enterprise_manager_for_virtualization 13.2.3 - - cpe:2.3:a:oracle:enterprise_manager_for_virtualization:13.2.3:*:*:*:*:*:*:*
oracle enterprise_manager_for_virtualization 13.3.1 - - cpe:2.3:a:oracle:enterprise_manager_for_virtualization:13.3.1:*:*:*:*:*:*:*
oracle financial_services_analytical_applications_infrastructure 8.0.2.0.0 - - cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.2.0.0:*:*:*:*:*:*:*
oracle financial_services_analytical_applications_infrastructure 8.0.3.0.0 - - cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.3.0.0:*:*:*:*:*:*:*
oracle financial_services_analytical_applications_infrastructure 8.0.4.0.0 - - cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.4.0.0:*:*:*:*:*:*:*
oracle financial_services_analytical_applications_infrastructure 8.0.5.0.0 - - cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.5.0.0:*:*:*:*:*:*:*
oracle financial_services_analytical_applications_infrastructure 8.0.6.0.0 - - cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.6.0.0:*:*:*:*:*:*:*
oracle financial_services_analytical_applications_infrastructure 8.0.7.0.0 - - cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.7.0.0:*:*:*:*:*:*:*
oracle global_lifecycle_management_opatchauto * - - cpe:2.3:a:oracle:global_lifecycle_management_opatchauto:*:*:*:*:*:*:*:*
oracle primavera_unifier * - - cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:*
oracle primavera_unifier 16.1 - - cpe:2.3:a:oracle:primavera_unifier:16.1:*:*:*:*:*:*:*
oracle primavera_unifier 16.2 - - cpe:2.3:a:oracle:primavera_unifier:16.2:*:*:*:*:*:*:*
oracle primavera_unifier 18.8 - - cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:*
oracle utilities_advanced_spatial_and_operational_analytics 2.7.0.1 - - cpe:2.3:a:oracle:utilities_advanced_spatial_and_operational_analytics:2.7.0.1:*:*:*:*:*:*:*
oracle webcenter_portal 12.2.1.3.0 - - cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:*
解决方案
中文解决方案:
（暂无数据）
英文解决方案:
（暂无数据）
临时解决方案:
（暂无数据）
参考链接
1040360 vdb-entry
cve.org
访问
RHSA-2017:1840 vendor-advisory
cve.org
访问
RHSA-2017:2547 vendor-advisory
cve.org
访问
RHSA-2017:1836 vendor-advisory
cve.org
访问
RHSA-2017:1835 vendor-advisory
cve.org
访问
RHSA-2018:1449 vendor-advisory
cve.org
访问
1039744 vdb-entry
cve.org
访问
1039947 vdb-entry
cve.org
访问
RHSA-2017:2635 vendor-advisory
cve.org
访问
RHSA-2017:2638 vendor-advisory
cve.org
访问
RHSA-2018:1450 vendor-advisory
cve.org
访问
RHSA-2017:3458 vendor-advisory
cve.org
访问
RHSA-2018:0294 vendor-advisory
cve.org
访问
RHSA-2017:1837 vendor-advisory
cve.org
访问
RHSA-2017:1834 vendor-advisory
cve.org
访问
RHSA-2017:2546 vendor-advisory
cve.org
访问
RHSA-2017:2636 vendor-advisory
cve.org
访问
RHSA-2017:3455 vendor-advisory
cve.org
访问
RHSA-2017:2477 vendor-advisory
cve.org
访问
RHSA-2017:3456 vendor-advisory
cve.org
访问
RHSA-2018:0342 vendor-advisory
cve.org
访问
RHSA-2017:1839 vendor-advisory
cve.org
访问
99623 vdb-entry
cve.org
访问
RHSA-2017:2637 vendor-advisory
cve.org
访问
RHSA-2017:3454 vendor-advisory
cve.org
访问
DSA-4004 vendor-advisory
cve.org
访问
RHSA-2017:3141 vendor-advisory
cve.org
访问
RHSA-2017:2633 vendor-advisory
cve.org
访问
[lucene-solr-user] 20190104 Re: SOLR v7 Security Issues Caused Denial of Use - Sonatype Application Composition Report mailing-list
cve.org
访问
[lucene-dev] 20190325 [jira] [Closed] (SOLR-13110) CVE-2017-7525 Threat Level 9 Against Solr v7.6. org.codehaus.jackson : jackson-mapper-asl : 1.9.13. .A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, ... mailing-list
cve.org
访问
[lucene-dev] 20190325 [jira] [Updated] (SOLR-13110) CVE-2017-7525 Threat Level 9 Against Solr v7.6. org.codehaus.jackson : jackson-mapper-asl : 1.9.13. .A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, ... mailing-list
cve.org
访问
[lucene-dev] 20190325 [jira] [Assigned] (SOLR-13110) CVE-2017-7525 Threat Level 9 Against Solr v7.6. org.codehaus.jackson : jackson-mapper-asl : 1.9.13. .A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, ... mailing-list
cve.org
访问
[lucene-dev] 20190325 [jira] [Resolved] (SOLR-13110) CVE-2017-7525 Threat Level 9 Against Solr v7.6. org.codehaus.jackson : jackson-mapper-asl : 1.9.13. .A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, ... mailing-list
cve.org
访问
[lucene-dev] 20190325 [jira] [Updated] (SOLR-13110) CVE-2017-7525 Threat Level 9 Against Solr v7.6. org.codehaus.jackson : jackson-mapper-asl : 1.9.13. .A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, ... mailing-list
cve.org
访问
RHSA-2019:0910 vendor-advisory
cve.org
访问
RHSA-2019:2858 vendor-advisory
cve.org
访问
RHSA-2019:3149 vendor-advisory
cve.org
访问
[cassandra-commits] 20191113 [jira] [Created] (CASSANDRA-15416) CVE-2017-7525 ( jackson-databind is vulnerable to Remote Code Execution) on version 3.11.4 mailing-list
cve.org
访问
[druid-commits] 20191115 [GitHub] [incubator-druid] ccaominh opened a new pull request #8878: Address security vulnerabilities mailing-list
cve.org
访问
[lucene-solr-user] 20191218 CVE-2017-7525 fix for Solr 7.7.x mailing-list
cve.org
访问
[lucene-solr-user] 20191218 Re: CVE-2017-7525 fix for Solr 7.7.x mailing-list
cve.org
访问
[lucene-solr-user] 20191219 Re: CVE-2017-7525 fix for Solr 7.7.x mailing-list
cve.org
访问
[debian-lts-announce] 20200131 [SECURITY] [DLA 2091-1] libjackson-json-java security update mailing-list
cve.org
访问
无标题 x_refsource_CONFIRM
cve.org
访问
无标题 x_refsource_CONFIRM
cve.org
访问
无标题 x_refsource_CONFIRM
cve.org
访问
无标题 x_refsource_CONFIRM
cve.org
访问
无标题 x_refsource_MISC
cve.org
访问
无标题 x_refsource_MISC
cve.org
访问
[debian-lts-announce] 20200824 [SECURITY] [DLA 2342-1] libjackson-json-java security update mailing-list
cve.org
访问
无标题 x_refsource_MISC
cve.org
访问
无标题 x_refsource_CONFIRM
cve.org
访问
无标题 x_refsource_CONFIRM
cve.org
访问
无标题 x_refsource_CONFIRM
cve.org
访问
无标题 x_refsource_CONFIRM
cve.org
访问
无标题 x_refsource_CONFIRM
cve.org
访问
无标题 x_refsource_CONFIRM
cve.org
访问
[spark-issues] 20210223 [jira] [Created] (SPARK-34511) Current Security vulnerabilities in spark libraries mailing-list
cve.org
访问
[cassandra-commits] 20210927 [jira] [Commented] (CASSANDRA-15416) CVE-2017-7525 ( jackson-databind is vulnerable to Remote Code Execution) on version 3.11.4 mailing-list
cve.org
访问
[cassandra-commits] 20210927 [jira] [Updated] (CASSANDRA-15416) CVE-2017-7525 ( jackson-databind is vulnerable to Remote Code Execution) on version 3.11.4 mailing-list
cve.org
访问
CVSS评分详情
9.8
CRITICAL
CVSS向量: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS版本: 3.1
机密性
HIGH
完整性
HIGH
可用性
HIGH
时间信息
发布时间:
2018-02-06 15:00:00
修改时间:
2024-09-17 02:21:29
创建时间:
2025-11-11 15:34:52
更新时间:
2025-11-11 15:53:08
利用信息
暂无可利用代码信息
数据源详情
数据源 记录ID 版本 提取时间
CVE cve_CVE-2017-7525 2025-11-11 15:19:32 2025-11-11 07:34:52
NVD nvd_CVE-2017-7525 2025-11-11 14:55:36 2025-11-11 07:43:29
CNNVD cnnvd_CNNVD-201707-1181 2025-11-11 15:09:51 2025-11-11 07:53:08
版本与语言
当前版本: v3
主要语言: EN
支持语言:
EN ZH
安全公告
暂无安全公告信息
变更历史
v3 CNNVD
2025-11-11 15:53:08
vulnerability_type: 未提取 → 代码问题; cnnvd_id: 未提取 → CNNVD-201707-1181; data_sources: ['cve', 'nvd'] → ['cnnvd', 'cve', 'nvd']
查看详细变更
  • vulnerability_type: 未提取 -> 代码问题
  • cnnvd_id: 未提取 -> CNNVD-201707-1181
  • data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
v2 NVD
2025-11-11 15:43:29
severity: SeverityLevel.MEDIUM → SeverityLevel.CRITICAL; cvss_score: 未提取 → 9.8; cvss_vector: NOT_EXTRACTED → CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; cvss_version: NOT_EXTRACTED → 3.1; affected_products_count: 3 → 45; data_sources: ['cve'] → ['cve', 'nvd']
查看详细变更
  • severity: SeverityLevel.MEDIUM -> SeverityLevel.CRITICAL
  • cvss_score: 未提取 -> 9.8
  • cvss_vector: NOT_EXTRACTED -> CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  • cvss_version: NOT_EXTRACTED -> 3.1
  • affected_products_count: 3 -> 45
  • data_sources: ['cve'] -> ['cve', 'nvd']