CVE-2017-7525

CRITICAL9.8EPSS 82.4%

jackson-databind - security update

發布日:2018/10/16修改日:2026/4/28
也稱為:DEBIAN-CVE-2017-7525

描述

A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.

受影響套件(4)

CVSS 分數

來源版本嚴重程度向量
osvCVSS 3.1CRITICAL9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

參考連結(67)