CVE-2017-17485 CVE-2017-17485

漏洞描述

FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the Spring libraries are available in the classpath.

影响产品

redhatjboss_enterprise_application_platform查看产品 →fasterxmljackson-databind查看产品 →

修复建议

建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。

参考链接

漏洞与影响对象	风险等级	CVSS	EPSS	利用情报	披露时间
snoop_servlet Snoop Servlet - Information Disclosure Apache Tomcat Jetty Resin+2	低危	—	—	PoCEXP	2024/07/11
CVE-2021-4104RCE CVE-2021-4104 Fedora Weblogic Server jboss_enterprise_application_platform+2	高危	7.5	72.2%	PoCEXP	2021/12/14
CVE-2017-7525RCE CVE-2017-7525 jboss_enterprise_application_platform jackson-databind	严重	9.8	77.3%	PoCEXP	2018/02/06
CVE-2015-7501RCE Red Hat JBoss - Insecure Deserialization jboss_enterprise_application_platform	严重	9.8	74.8%	PoCEXP	2017/11/09
CVE-2014-0224 CVE-2014-0224 OpenSSL Node.js Fedora+3	高危	7.4	93.1%	PoCEXP	2014/06/05
CVE-2010-1871RCE CVE-2010-1871 jboss_enterprise_application_platform	高危	8.8	93.9%	PoCEXP	2010/08/05

利用情报状态

漏洞描述

影响产品

修复建议

参考链接

同产品关联漏洞