7.5 - DSA-4004

Executive Summary

Summary
Title	jackson-databind security update

Informations
Name	DSA-4004	First vendor Publication	2017-10-20
Vendor	Debian	Last vendor Modification	2017-10-20
Severity (Vendor)	N/A	Revision	1

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score	NA
Base Score	NA	Environmental Score	NA
impact SubScore	NA	Temporal Score	NA
Exploitabality Sub Score	NA

Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:P)
Cvss Base Score	7.5	Attack Range	Network
Cvss Impact Score	6.4	Attack Complexity	Low
Cvss Expoit Score	10	Authentication	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Liao Xinxi discovered that jackson-databind, a Java library used to parse JSON and other data formats, did not properly validate user input before attemtping deserialization. This allowed an attacker to perform code execution by providing maliciously crafted input.

For the oldstable distribution (jessie), this problem has been fixed in version 2.4.2-2+deb8u1.

For the stable distribution (stretch), this problem has been fixed in version 2.8.6-1+deb9u1.

We recommend that you upgrade your jackson-databind packages.

Original Source

Url : http://www.debian.org/security/2017/dsa-4004

CPE : Common Platform Enumeration

Type	Description	Count
Application	Fasterxml Jackson-Databind cpe:2.3:a:fasterxml:jackson-databind:2.9.0:prerelease2:::::: cpe:2.3:a:fasterxml:jackson-databind:2.9.0:prerelease1:::::: cpe:2.3:a:fasterxml:jackson-databind:2.8.0:rc1:::::: cpe:2.3:a:fasterxml:jackson-databind:2.8.0:rc2:::::: cpe:2.3:a:fasterxml:jackson-databind:2.7.0:rc3:::::: cpe:2.3:a:fasterxml:jackson-databind:2.7.0:rc1:::::: cpe:2.3:a:fasterxml:jackson-databind:2.7.0:rc2:::::: cpe:2.3:a:fasterxml:jackson-databind::::::::	8
Application	Netapp Oncommand Balance cpe:2.3:a:netapp:oncommand_balance:-:::::::*	1
Application	Netapp Oncommand Performance Manager cpe:2.3:a:netapp:oncommand_performance_manager:-:::::vmware_vsphere:: cpe:2.3:a:netapp:oncommand_performance_manager:-:::::linux::	2
Application	Netapp Oncommand Shift cpe:2.3:a:netapp:oncommand_shift:-:::::::*	1
Application	Netapp Snapcenter cpe:2.3:a:netapp:snapcenter:-:::::::*	1
Application	Oracle Banking Platform cpe:2.3:a:oracle:banking_platform:2.6.2:::::::* cpe:2.3:a:oracle:banking_platform:2.6.1:::::::* cpe:2.3:a:oracle:banking_platform:2.6.0:::::::* cpe:2.3:a:oracle:banking_platform:2.5.0:::::::*	4
Application	Oracle Communications Billing And Revenue Management cpe:2.3:a:oracle:communications_billing_and_revenue_management:12.0:::::::* cpe:2.3:a:oracle:communications_billing_and_revenue_management:7.5:::::::*	2
Application	Oracle Communications Diameter Signaling Route cpe:2.3:a:oracle:communications_diameter_signaling_route:::::::: cpe:2.3:a:oracle:communications_diameter_signaling_route:-:::::::*	2
Application	Oracle Communications Instant Messaging Server cpe:2.3:a:oracle:communications_instant_messaging_server:10.0.1.2.0:::::::* cpe:2.3:a:oracle:communications_instant_messaging_server:10.0.1:::::::*	2
Application	Oracle Enterprise Manager For Virtualization cpe:2.3:a:oracle:enterprise_manager_for_virtualization:13.3.1:::::::* cpe:2.3:a:oracle:enterprise_manager_for_virtualization:13.2.3:::::::* cpe:2.3:a:oracle:enterprise_manager_for_virtualization:13.2.2:::::::*	3
Application	Oracle Financial Services Analytical Applications Infrastructure cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.7.0.0:::::::* cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.6.0.0:::::::* cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.5.0.0:::::::* cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.4.0.0:::::::* cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.3.0.0:::::::* cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.2.0.0:::::::*	6
Application	Oracle Global Lifecycle Management Opatchauto cpe:2.3:a:oracle:global_lifecycle_management_opatchauto::::::::	1
Application	Oracle Primavera Unifier cpe:2.3:a:oracle:primavera_unifier:18.8:::::::* cpe:2.3:a:oracle:primavera_unifier:17.9:::::::* cpe:2.3:a:oracle:primavera_unifier:17.8:::::::* cpe:2.3:a:oracle:primavera_unifier:17.7:::::::* cpe:2.3:a:oracle:primavera_unifier:17.6:::::::* cpe:2.3:a:oracle:primavera_unifier:17.5:::::::* cpe:2.3:a:oracle:primavera_unifier:17.4:::::::* cpe:2.3:a:oracle:primavera_unifier:17.3:::::::* cpe:2.3:a:oracle:primavera_unifier:17.2:::::::* cpe:2.3:a:oracle:primavera_unifier:17.12:::::::* cpe:2.3:a:oracle:primavera_unifier:17.11:::::::* cpe:2.3:a:oracle:primavera_unifier:17.10:::::::* cpe:2.3:a:oracle:primavera_unifier:17.1:::::::* cpe:2.3:a:oracle:primavera_unifier:17.0:::::::* cpe:2.3:a:oracle:primavera_unifier:16.2.4.0:::::::* cpe:2.3:a:oracle:primavera_unifier:16.2.1.0:::::::* cpe:2.3:a:oracle:primavera_unifier:16.2:::::::* cpe:2.3:a:oracle:primavera_unifier:16.1:::::::* cpe:2.3:a:oracle:primavera_unifier:16.0:::::::* cpe:2.3:a:oracle:primavera_unifier:15.2:::::::* cpe:2.3:a:oracle:primavera_unifier:15.1:::::::* cpe:2.3:a:oracle:primavera_unifier:15.0:::::::* cpe:2.3:a:oracle:primavera_unifier:10.2:::::::* cpe:2.3:a:oracle:primavera_unifier:10.1:::::::* cpe:2.3:a:oracle:primavera_unifier:10.0:::::::* cpe:2.3:a:oracle:primavera_unifier:9.14:::::::* cpe:2.3:a:oracle:primavera_unifier:9.13:::::::* cpe:2.3:a:oracle:primavera_unifier::::::android::* cpe:2.3:a:oracle:primavera_unifier::::::iphone_os::* cpe:2.3:a:oracle:primavera_unifier:::::android:::* cpe:2.3:a:oracle:primavera_unifier:::::iphone_os:::*	31
Application	Oracle Utilities Advanced Spatial And Operational Analytics cpe:2.3:a:oracle:utilities_advanced_spatial_and_operational_analytics:2.7.0.1:::::::*	1
Application	Oracle Webcenter Portal cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:::::::*	1
Application	Redhat Openshift Container Platform cpe:2.3:a:redhat:openshift_container_platform:3.11:::::::*	1
Os	Debian Debian Linux cpe:2.3:o:debian:debian_linux:9.0:::::::* cpe:2.3:o:debian:debian_linux:8.0:::::::*	2

Snort® IPS/IDS

Date	Description
2017-12-29	Jackson databind deserialization remote code execution attempt RuleID : 45016 - Revision : 3 - Type : FILE-OTHER
2017-12-29	Jackson databind deserialization remote code execution attempt RuleID : 45015 - Revision : 3 - Type : FILE-OTHER
2017-12-29	Jackson databind deserialization remote code execution attempt RuleID : 45014 - Revision : 3 - Type : FILE-OTHER
2017-12-29	Jackson databind deserialization remote code execution attempt RuleID : 45013 - Revision : 3 - Type : FILE-OTHER
2017-12-29	Jackson databind deserialization remote code execution attempt RuleID : 45012 - Revision : 4 - Type : FILE-OTHER
2017-12-29	Jackson databind deserialization remote code execution attempt RuleID : 45011 - Revision : 3 - Type : FILE-OTHER
2017-12-29	Jackson databind deserialization remote code execution attempt RuleID : 45010 - Revision : 3 - Type : FILE-OTHER
2017-12-29	Jackson databind deserialization remote code execution attempt RuleID : 45009 - Revision : 3 - Type : FILE-OTHER
2017-12-29	Jackson databind deserialization remote code execution attempt RuleID : 45008 - Revision : 3 - Type : FILE-OTHER
2017-12-29	Jackson databind deserialization remote code execution attempt RuleID : 45007 - Revision : 3 - Type : FILE-OTHER
2017-12-29	Jackson databind deserialization remote code execution attempt RuleID : 45006 - Revision : 4 - Type : FILE-OTHER
2017-12-29	Jackson databind deserialization remote code execution attempt RuleID : 45005 - Revision : 4 - Type : FILE-OTHER
2017-12-29	Jackson databind deserialization remote code execution attempt RuleID : 45004 - Revision : 3 - Type : FILE-OTHER
2017-12-29	Jackson databind deserialization remote code execution attempt RuleID : 45003 - Revision : 3 - Type : FILE-OTHER
2017-12-29	Jackson databind deserialization remote code execution attempt RuleID : 45002 - Revision : 3 - Type : FILE-OTHER

Nessus® Vulnerability Scanner

Date	Description
2018-11-29	Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_93f8e0fff33d11e8be460019dbb15b3f.nasl - Type : ACT_GATHER_INFO
2018-05-04	Name : The remote Debian host is missing a security-related update. File : debian_DSA-4190.nasl - Type : ACT_GATHER_INFO
2017-12-15	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2017-3455.nasl - Type : ACT_GATHER_INFO
2017-12-15	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2017-3454.nasl - Type : ACT_GATHER_INFO
2017-12-14	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2017-3458.nasl - Type : ACT_GATHER_INFO
2017-12-04	Name : A web application running on the remote host uses a Java framework that is af... File : struts_2_5_14_1.nasl - Type : ACT_GATHER_INFO
2017-11-17	Name : The remote Debian host is missing a security-related update. File : debian_DSA-4037.nasl - Type : ACT_GATHER_INFO
2017-11-14	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2017-3189.nasl - Type : ACT_GATHER_INFO
2017-11-10	Name : The remote Red Hat host is missing a security update. File : redhat-RHSA-2017-3141.nasl - Type : ACT_GATHER_INFO
2017-10-23	Name : The remote Debian host is missing a security-related update. File : debian_DSA-4004.nasl - Type : ACT_GATHER_INFO
2017-09-08	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2017-2638.nasl - Type : ACT_GATHER_INFO
2017-09-08	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2017-2637.nasl - Type : ACT_GATHER_INFO
2017-09-08	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2017-2636.nasl - Type : ACT_GATHER_INFO
2017-09-08	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2017-2635.nasl - Type : ACT_GATHER_INFO
2017-08-14	Name : The remote Fedora host is missing a security update. File : fedora_2017-f452765e1e.nasl - Type : ACT_GATHER_INFO
2017-08-14	Name : The remote Fedora host is missing a security update. File : fedora_2017-6a75c816fa.nasl - Type : ACT_GATHER_INFO
2017-08-11	Name : The remote Fedora host is missing a security update. File : fedora_2017-8df9efed5f.nasl - Type : ACT_GATHER_INFO
2017-08-03	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2017-1834.nasl - Type : ACT_GATHER_INFO
2017-08-03	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2017-1837.nasl - Type : ACT_GATHER_INFO
2017-08-03	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2017-1835.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.

Date	Informations
2018-02-28 00:21:10	Multiple Updates
2018-02-08 09:21:58	Multiple Updates
2017-11-18 13:24:06	Multiple Updates
2017-10-24 13:25:29	Multiple Updates
2017-10-20 09:22:15	First insertion

Global Informations

Type	Count
CPE ID(s)	69
Snort® Rule(s)	15
Nessus® Exploit(s)	20

	Related
9.8	CVE-2017-7525
7.5	DSA-4037
Info : listing not affected by your CVSS Env Score

Same Subject	Severity
Login to view 2 more Alert(s)

7.5 - DSA-4004

Executive Summary

Security-Database Scoring CVSS v3

Security-Database Scoring CVSS v2

Detail

Original Source

CPE : Common Platform Enumeration

Snort® IPS/IDS

Nessus® Vulnerability Scanner

Alert History

Global Informations

Open Standards

Other Databases

COMPANY

STANDARDS

RECENT POSTS

MENU