dbcve.org
Debian LinuxOperating system · Debian

CVE-2017-17485

CRITICAL · 9.8 CVSS v3.1 Published 2018-01-10
Fix available
A fix is available. Upgrade to 2.6.7.3 / 2.7.9.2 or later.
See remediation →
100/100
Remediation priority · Urgent
Remotely reachable No privileges Zero-click

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the Spring libraries are available in the classpath.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

Jackson-databind through 2.9.3 contains an incomplete fix for CVE-2017-7525, allowing unauthenticated remote code execution via malicious JSON input to the readValue method. The blacklist protection can be bypassed when Spring libraries are present in the classpath, enabling arbitrary code execution through crafted deserialization payloads.

MitigationUpgrade Jackson-databind to version 2.9.4 or later which contains the complete blacklist fix. If immediate upgrade is not feasible, disable default typing in ObjectMapper configuration or implement a custom deserialization whitelist as a defense-in-depth measure.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

NVD · CPE data
Debian LinuxOperating system
Affected:= 8.0= 9.0
Jboss Enterprise Application PlatformApplication
Affected:= 6.0.0= 6.4.0= 7.1
Openshift Container PlatformApplication
Affected:= 4.1= 3.11
Jackson DatabindApplication
Affected:< 2.6.7.3>= 2.7.0, < 2.7.9.2>= 2.8.0, < 2.8.11>= 2.9.0, < 2.9.4
E Series Santricity Os ControllerApplication
Affected:>= 11.0.0, <= 11.60.3
E Series Santricity Web Services ProxyApplication
Affected:all versions
Oncommand ShiftApplication
Affected:all versions
SnapcenterApplication
Affected:all versions

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Identify Jackson-databind version
    Locate the jackson-databind jar file in your application classpath and check its version. In Maven projects, examine the pom.xml for the jackson-databind dependency version. In Gradle projects, check build.gradle. For deployed applications, inspect the lib directory or WAR file for jackson-databind-*.jar and note the version in the filename.
    Affected if The installed version is less than 2.6.7.3, OR between 2.7.0 and 2.7.9.2 inclusive, OR between 2.8.0 and 2.8.11 inclusive, OR between 2.9.0 and 2.9.4 inclusive.
  2. Check for Spring libraries in classpath
    Scan the application classpath for Spring Framework libraries. Search for jars with names containing 'spring-' in the lib directory, pom.xml, or build.gradle dependencies. Common Spring libraries include spring-core, spring-beans, spring-context, spring-expression, or spring-aop.
    Affected if Any Spring Framework libraries are present in the classpath alongside a vulnerable Jackson-databind version.
  3. Verify if readValue or similar deserialization methods are used
    Search application source code for calls to ObjectMapper.readValue(), JsonParser.readValueAs(), or similar deserialization methods that accept untrusted JSON input. Also check for @RequestBody annotations in Spring controllers that automatically deserialize JSON.
    Affected if The application uses readValue or other Jackson deserialization methods to process JSON input from untrusted sources.
  4. Confirm default typing configuration
    Inspect ObjectMapper configuration code for enableDefaultTyping() calls or DEFAULT_JSON_INCLUSION settings. Check for @JsonTypeInfo annotations with USE_DEFAULT_TYPE or similar type information inclusion. Review Spring configuration files for Jackson mapper customizations.
    Affected if Default typing is enabled on the ObjectMapper, which widens the attack surface for this deserialization vulnerability.

Your environment is affected if you have a vulnerable Jackson-databind version (less than 2.6.7.3, between 2.7.0-2.7.9.2, 2.8.0-2.8.11, or 2.9.0-2.9.4) AND Spring libraries are present in the classpath AND your application deserializes untrusted JSON via Jackson.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Upgrade available Upgrade to 2.6.7.3 / 2.7.9.2 / 2.8.11 or later
Fixed in 2.6.7.32.7.9.22.8.11
Interim mitigation

Upgrade Jackson-databind to version 2.9.4 or later which contains the complete blacklist fix. If immediate upgrade is not feasible, disable default typing in ObjectMapper configuration or implement a custom deserialization whitelist as a defense-in-depth measure.

Recommended fix High confidence

Jackson Databind 2.9.4 (or latest 2.x release)

  1. Identify the current Jackson Databind version in use by checking project dependencies (Maven pom.xml, Gradle build.gradle, or JAR manifest)
  2. Upgrade Jackson Databind to version 2.9.4 or later (or at minimum 2.8.11 if staying on 2.8.x branch, 2.7.9.2 for 2.7.x, or 2.6.7.3 for 2.6.x)
  3. If using Maven, update the dependency: <dependency><groupId>com.fasterxml.jackson.core</groupId><artifactId>jackson-databind</artifactId><version>2.9.4</version></dependency>
  4. If using Gradle, update: compile('com.fasterxml.jackson.core:jackson-databind:2.9.4')
  5. Rebuild and redeploy the application
  6. Test application functionality to ensure the upgrade does not break existing features
Caveat Minor: Verify no regression in JSON parsing behavior; some edge-case serialization/deserialization features may have changed

Generated from the published advisory — verify against the referenced sources before acting.

Fix this in Debian Linux Scoped from the published advisory
  • Consultation6.0 h
  • Implementation4.0 h
  • Testing8.0 h
  • Review / QA4.0 h
22.0 hours of engineering $3,840
Get the upgrade done

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $6,144.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2017-17485 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2017-17485 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data