CoreCVE
Back

CRITICAL

jackson-databind: incomplete fix for CVE-2017-7525 permits unsafe serialization via c3p0 libraries

Published Feb 26, 2018

Description

FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the c3p0 libraries are available in the classpath.

Affected products

Remediation

Red Hat statement

Subscription Asset Manager is now in a reduced support phase receiving only Critical impact security fixes. This issue has been rated as having a security impact of Moderate, and is not currently planned to be addressed in future updates. Satellite 6.2 does not support c3p0 classes. Since the latter are required for this flaw, therefore Satellite 6.2 is not affected. Satellite 6.3 and 6.4 are not affected because Candlepin does not use polymorphic deserialization.

Red Hat mitigation

Advice on how to remain safe while using JAX-RS webservices on JBoss EAP 7.x is available here: https://access.redhat.com/solutions/3279231 https://github.com/FasterXML/jackson-docs/wiki/JacksonPolymorphicDeserialization General Mitigation: Try to avoid * Deserialization from sources you do not control * `enableDefaultTyping()` * `@JsonTypeInfo using `id.CLASS` or `id.MINIMAL_CLASS`

Metrics

Weaknesses (3)

CWE-184

CWE-20

Improper Input Validation

CWE-502

Deserialization of Untrusted Data

References (40)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner mitre
Published Feb 26, 2018
Updated Aug 5, 2024
Reserved Feb 26, 2018
Link CVE-2018-7489
CISA Vulnrichment
Updated n/a
NVD
Status Modified
Modified Jun 17, 2026
Link CVE-2018-7489
Red Hat
Severity Moderate
Public date Feb 26, 2018
Links CVE-2018-7489 - Bugzilla
GHSA-CGGJ-FVV3-CQWV