CVE:CVE-2017-15095
CNNVD:CNNVD-201802-177
FasterXML jackson-databind是FasterXML公司的一个基于JAVA可以将XML和JSON等数据格式与JAVA对象进行转换的库。Jackson可以轻松的将Java对象转换成json对象和xml文档，同样也可以将json、xml转换成Java对象。
FasterXML Jackson-databind 2.8.10之前版本和2.9.1之前版本中存在代码问题漏洞。攻击者可通过向ObjectMapper的readValue方法发送特制的输入利用该漏洞执行代码。
solution:Upgrade fasterxml jackson-databind to a higher version than 2.6.7.3,2.7.9.2,2.8.10,2.9.0,2.9.0:prerelease1,2.9.0:prerelease2,2.9.0:prerelease3,2.9.0:prerelease4,and avoid the version [2.6.0,2.6.7.3),[2.7.0,2.7.9.2),[2.8.0,2.8.10),2.9.0,2.9.0:prerelease1,2.9.0:prerelease2,2.9.0:prerelease3,2.9.0:prerelease4; Upgrade debian debian_linux to a higher version than 8.0,9.0,and avoid the version 8.0,9.0; Upgrade redhat openshift_container_platform to a higher version than 3.11,4.1,and avoid the version 3.11,4.1; Upgrade redhat satellite to a higher version than 6.4,and avoid the version 6.4; Upgrade redhat satellite_capsule to a higher version than 6.4,and avoid the version 6.4; Upgrade redhat jboss_enterprise_application_platform to a higher version than 6.0.0,6.4.0,7.1.0,and avoid the version 6.0.0,6.4.0,7.1.0; Upgrade netapp oncommand_balance to a higher version than -; Upgrade netapp oncommand_performance_manager to a higher version than -; Upgrade netapp oncommand_shift to a higher version than -; Upgrade netapp snapcenter to a higher version than -; Upgrade oracle banking_platform to a higher version than 2.5.0,2.6.0,2.6.1,2.6.2,and avoid the version 2.5.0,2.6.0,2.6.1,2.6.2; Upgrade oracle clusterware to a higher version than 12.1.0.2.0,and avoid the version 12.1.0.2.0; Upgrade oracle communications_billing_and_revenue_management to a higher version than 7.5,12.0,and avoid the version 7.5,12.0; Upgrade oracle communications_diameter_signaling_router to a higher version than 8.3,and avoid the version (,8.3); Upgrade oracle communications_instant_messaging_server to a higher version than 10.0.1.2.0,and avoid the version 10.0.1.2.0; Upgrade oracle database_server to a higher version than 12.2.0.1,18.1,and avoid the version 12.2.0.1,18.1; Upgrade oracle enterprise_manager_for_virtualization to a higher version than 13.2.2,13.2.3,13.3.1,and avoid the version 13.2.2,13.2.3,13.3.1; Upgrade oracle financial_services_analytical_applications_infrastructure to a higher version than 8.0.2,8.0.3,8.0.4,8.0.5,8.0.6,8.0.7,and avoid the version 8.0.2,8.0.3,8.0.4,8.0.5,8.0.6,8.0.7; Upgrade oracle global_lifecycle_management_opatchauto to a higher version than 12.2.0.1.14,and avoid the version (,12.2.0.1.14); Upgrade oracle identity_manager to a higher version than 11.1.2.3.0,12.2.1.3.0,and avoid the version 11.1.2.3.0,12.2.1.3.0; Upgrade oracle jd_edwards_enterpriseone_tools to a higher version than 9.2,and avoid the version 9.2; Upgrade oracle primavera_unifier to a higher version than 17.12,16.1,16.2,18.8,and avoid the version [17.1,17.12],16.1,16.2,18.8; Upgrade oracle utilities_advanced_spatial_and_operational_analytics to a higher version than 2.7.0.1,and avoid the version 2.7.0.1; Upgrade oracle webcenter_portal to a higher version than 12.2.1.3.0,and avoid the version 12.2.1.3.0