UBUNTU-CVE-2017-7525

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/CVE-2017-7525

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2017/UBUNTU-CVE-2017-7525.json

JSON Data

https://api.osv.dev/v1/vulns/UBUNTU-CVE-2017-7525

Related

Published

2018-02-06T15:29:00Z

Modified

2024-10-15T14:06:18Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
9.8 (Critical) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

[none]

Details

A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.

References

Affected packages

Ubuntu:Pro:14.04:LTS / jackson-databind

Package

Name: jackson-databind
Purl: pkg:deb/ubuntu/jackson-databind?arch=src?distro=trusty/esm

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.2.2-1ubuntu0.1~esm1

Affected versions

2.*

2.2.2-1

Ecosystem specific

{
    "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "2.2.2-1ubuntu0.1~esm1",
            "binary_name": "libjackson2-databind-java"
        },
        {
            "binary_version": "2.2.2-1ubuntu0.1~esm1",
            "binary_name": "libjackson2-databind-java-doc"
        }
    ]
}

Ubuntu:Pro:14.04:LTS / libjackson-json-java

Package

Name: libjackson-json-java
Purl: pkg:deb/ubuntu/libjackson-json-java?arch=src?distro=trusty/esm

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.9.2-3+deb8u1build0.14.04.1~esm1

Affected versions

1.*

1.9.2-1

1.9.2-2

1.9.2-3

Ecosystem specific

{
    "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "1.9.2-3+deb8u1build0.14.04.1~esm1",
            "binary_name": "libjackson-json-java"
        },
        {
            "binary_version": "1.9.2-3+deb8u1build0.14.04.1~esm1",
            "binary_name": "libjackson-json-java-doc"
        }
    ]
}

Ubuntu:16.04:LTS / libjackson-json-java

Package

Name: libjackson-json-java
Purl: pkg:deb/ubuntu/libjackson-json-java?arch=src?distro=xenial

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.9.2-7ubuntu0.2

Affected versions

1.*

1.9.2-3

1.9.2-4

1.9.2-5

1.9.2-6

1.9.2-7

Ecosystem specific

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "1.9.2-7ubuntu0.2",
            "binary_name": "libjackson-json-java"
        },
        {
            "binary_version": "1.9.2-7ubuntu0.2",
            "binary_name": "libjackson-json-java-doc"
        }
    ]
}

Ubuntu:Pro:16.04:LTS / jackson-databind

Package

Name: jackson-databind
Purl: pkg:deb/ubuntu/jackson-databind?arch=src?distro=esm-apps/xenial

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.4.2-3ubuntu0.1~esm1

Affected versions

2.*

2.4.2-2

2.4.2-3

Ecosystem specific

{
    "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "2.4.2-3ubuntu0.1~esm1",
            "binary_name": "libjackson2-databind-java"
        },
        {
            "binary_version": "2.4.2-3ubuntu0.1~esm1",
            "binary_name": "libjackson2-databind-java-doc"
        }
    ]
}

Ubuntu:18.04:LTS / jackson-databind

Package

Name: jackson-databind
Purl: pkg:deb/ubuntu/jackson-databind?arch=src?distro=bionic

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.9.1-1

Affected versions

2.*

2.8.6-1

Ecosystem specific

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "2.9.1-1",
            "binary_name": "libjackson2-databind-java"
        },
        {
            "binary_version": "2.9.1-1",
            "binary_name": "libjackson2-databind-java-doc"
        }
    ]
}

Ubuntu:Pro:18.04:LTS / libjackson-json-java

Package

Name: libjackson-json-java
Purl: pkg:deb/ubuntu/libjackson-json-java?arch=src?distro=esm-apps/bionic

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.9.2-8

1.9.2-9

1.9.13-1~18.04

Ecosystem specific

{
    "ubuntu_priority": "medium"
}

Ubuntu:20.04:LTS / libjackson-json-java

Package

Name: libjackson-json-java
Purl: pkg:deb/ubuntu/libjackson-json-java?arch=src?distro=focal

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.9.13-1

Ecosystem specific

{
    "ubuntu_priority": "medium"
}

Ubuntu:22.04:LTS / libjackson-json-java

Package

Name: libjackson-json-java
Purl: pkg:deb/ubuntu/libjackson-json-java?arch=src?distro=jammy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.9.13-2

Ecosystem specific

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "1.9.13-2",
            "binary_name": "libjackson-json-java"
        },
        {
            "binary_version": "1.9.13-2",
            "binary_name": "libjackson-json-java-doc"
        }
    ]
}

Ubuntu:24.10 / libjackson-json-java

Package

Name: libjackson-json-java
Purl: pkg:deb/ubuntu/libjackson-json-java?arch=src?distro=oracular

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.9.13-2

Ecosystem specific

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "1.9.13-2",
            "binary_name": "libjackson-json-java"
        },
        {
            "binary_version": "1.9.13-2",
            "binary_name": "libjackson-json-java-doc"
        }
    ]
}

Ubuntu:24.04:LTS / libjackson-json-java

Package

Name: libjackson-json-java
Purl: pkg:deb/ubuntu/libjackson-json-java?arch=src?distro=noble

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.9.13-2

Ecosystem specific

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "1.9.13-2",
            "binary_name": "libjackson-json-java"
        },
        {
            "binary_version": "1.9.13-2",
            "binary_name": "libjackson-json-java-doc"
        }
    ]
}