CVE: 2017-15095 found in jackson-databind - Version: 2.4.2 [JAVA]

[github-actions[bot]]

Veracode Software Composition Analysis

Attribute	Details
Library	jackson-databind
Description	General data-binding functionality for Jackson: works on core streaming API
Language	JAVA
Vulnerability	Remote Code Execution (RCE) Through Deserialization
Vulnerability description	Jackson-databind is vulnerable to remote code execution (RCE) attacks. This is a follow-up similar attack of CVE-2017-7525. The attack is still possible because more dangerous classes were added in the later released versions and were not blacklisted.
CVE	2017-15095
CVSS score	7.5
Vulnerability present in version/s	2.0.0-RC1-2.7.9.1
Found library version/s	2.4.2
Vulnerability fixed in version	2.7.9.2
Library latest version	2.16.1
Fix

Links:

• https://sca.analysiscenter.veracode.com/vulnerability-database/libraries/908?version=2.4.2
• https://sca.analysiscenter.veracode.com/vulnerability-database/vulnerabilities/5364
• Patch: https://github.com/FasterXML/jackson-databind/compare/e20bcc877a8149a9c4ecd562209b3b3954b6dda2...ddfddfba

[github-actions[bot]]

Veracode issue link to PR: https://github.com/tsaekao/verademo-java/pull/2

[github-actions[bot]]

Veracode issue link to PR: https://github.com/tsaekao/verademo-java/pull/43