Django REST framework

Lookup for vulnerabilities affecting packages.

Vulnerability_id VCID-tfky-edec-13gw

Summary

Deserialization of Untrusted Data
A deserialization flaw was discovered in the jackson-databind which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the `readValue` method of the `ObjectMapper`.

Aliases

alias	CVE-2017-15095

Fixed_packages

url	pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.2
purl	pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.2
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.7.9.2

url	pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.10
purl	pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.10
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.10

url	pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1
purl	pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1

Affected_packages

url pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.0

purl pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-18u1-9nc1-2feh

vulnerability	VCID-8ec9-5qt4-duat

vulnerability	VCID-8mns-fyju-dqdr

vulnerability	VCID-d6ez-jva8-hyag

vulnerability	VCID-ez2q-xgz1-rkab

vulnerability	VCID-kdkp-1ucy-w3g1

vulnerability	VCID-m3y5-xa6w-83b6

vulnerability	VCID-p52x-ese3-qkha

vulnerability	VCID-rg7k-kaxv-2ubx

vulnerability	VCID-tfky-edec-13gw

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.0

url pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.0

purl pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-18u1-9nc1-2feh

vulnerability	VCID-8ec9-5qt4-duat

vulnerability	VCID-8mns-fyju-dqdr

vulnerability	VCID-d6ez-jva8-hyag

vulnerability	VCID-ez2q-xgz1-rkab

vulnerability	VCID-kdkp-1ucy-w3g1

vulnerability	VCID-m3y5-xa6w-83b6

vulnerability	VCID-p52x-ese3-qkha

vulnerability	VCID-tfky-edec-13gw

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.0

References

reference_url	https://github.com/FasterXML/jackson-databind/issues/1680
reference_id
reference_type
scores
url	https://github.com/FasterXML/jackson-databind/issues/1680

reference_url	https://github.com/FasterXML/jackson-databind/issues/1737
reference_id
reference_type
scores
url	https://github.com/FasterXML/jackson-databind/issues/1737

reference_url	http://www.securityfocus.com/bid/103880
reference_id
reference_type
scores
url	http://www.securityfocus.com/bid/103880

reference_url	http://www.securitytracker.com/id/1039769
reference_id
reference_type
scores
url	http://www.securitytracker.com/id/1039769

reference_url	https://nvd.nist.gov/vuln/detail/CVE-2017-15095
reference_id	CVE-2017-15095
reference_type
scores
url	https://nvd.nist.gov/vuln/detail/CVE-2017-15095

Weaknesses

cwe_id	1035
name	OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
description	Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017.

cwe_id	502
name	Deserialization of Untrusted Data
description	The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

cwe_id	937
name	OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
description	Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013.

Exploits

Severity_range_score null

Exploitability null

Weighted_severity null

Risk_score null

Resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-tfky-edec-13gw

Vulnerability Instance