CVE-2017-15095 in Oracle Communications Diameter Signaling Routerinfo

Summary

A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaw CVE-2017-7525 by blacklisting more classes that could be used maliciously.

Once again VulDB remains the best source for vulnerability data.

Reservation

10/08/2017

Disclosure

02/06/2018

Entries

VulDB provides additional information and datapoints for this CVE:

ID	Vulnerability	CWE	Exp	Cou	CVE
129471	Oracle Communications Diameter Signaling Router jackson-databind deserialization	502	Not defined	Official fix	CVE-2017-15095
125610	Oracle Retail Open Commerce Platform jackson-databind deserialization	502	Not defined	Official fix	CVE-2017-15095
125529	Oracle JD Edwards EnterpriseOne Tools Monitoring/Diagnostics deserialization	502	Not defined	Official fix	CVE-2017-15095
125528	Oracle JD Edwards EnterpriseOne Tools Business Logic Inf deserialization	502	Not defined	Official fix	CVE-2017-15095
125429	Oracle Identity Manager Installer deserialization	502	Not defined	Official fix	CVE-2017-15095
125380	Oracle Communications Instant Messaging Server jackson-databind deserialization	502	Not defined	Official fix	CVE-2017-15095
121566	Oracle Database Spatial deserialization	502	Not defined	Official fix	CVE-2017-15095
116824	Oracle Agile PLM Framework Web Client deserialization	502	Not defined	Official fix	CVE-2017-15095
116803	Oracle Retail Xstore Point of Service Xenvironment deserialization	502	Not defined	Official fix	CVE-2017-15095
116793	Oracle Retail Order Broker System Administration deserialization	502	Not defined	Official fix	CVE-2017-15095
116730	Oracle JD Edwards EnterpriseOne Tools EnterpriseOne Mobility Sec deserialization	502	Not defined	Official fix	CVE-2017-15095
116685	Oracle WebCenter Portal Security deserialization	502	Not defined	Official fix	CVE-2017-15095
116635	Oracle Banking Platform Infrastructure deserialization	502	Not defined	Official fix	CVE-2017-15095
116634	Oracle Banking Enterprise Product Manufacturing Infrastructure deserialization	502	Not defined	Official fix	CVE-2017-15095
116633	Oracle Banking Enterprise Originations Infrastructure deserialization	502	Not defined	Official fix	CVE-2017-15095
116632	Oracle Banking Enterprise Collections Infrastructure deserialization	502	Not defined	Official fix	CVE-2017-15095
116621	Oracle Enterprise Manager for Virtualization Generic Virtualization (jackson-databind) deserialization	502	Not defined	Official fix	CVE-2017-15095
116602	Oracle Primavera Unifier jackson-databind deserialization	502	Not defined	Official fix	CVE-2017-15095
116595	Oracle Communications Contacts Server REST deserialization	502	Not defined	Official fix	CVE-2017-15095
116594	Oracle Communications Calendar Server WCAP deserialization	502	Not defined	Official fix	CVE-2017-15095
112877	jackson-databind readValue deserialization	502	Not defined	Official fix	CVE-2017-15095

Description

CPE

CWE

CVSS

Exploits

History

Diff

Relate

Threat Intelligence

API JSON

API XML

API CSV

Sources

◂ PreviousOverviewNext ▸

Interested in the pricing of exploits?

See the underground prices here!