CVE:CVE-2017-17485
CNNVD:CNNVD-201712-478
FasterXML jackson-databind是FasterXML公司的一个基于JAVA可以将XML和JSON等数据格式与JAVA对象进行转换的库。Jackson可以轻松的将Java对象转换成json对象和xml文档，同样也可以将json、xml转换成Java对象。
FasterXML Jackson-databind 2.8.10及之前版本和2.9.x版本至2.9.3版本中存在代码问题漏洞。远程攻击者可通过向ObjectMapper的readValue方法发送恶意制作的JSON输入并绕过黑名单利用该漏洞执行代码。
solution:Upgrade fasterxml jackson-databind to a higher version than 2.6.7.3,2.7.9.2,2.8.11,2.9.4,and avoid the version (,2.6.7.3),[2.7.0,2.7.9.2),[2.8.0,2.8.11),[2.9.0,2.9.4); Upgrade debian debian_linux to a higher version than 8.0,9.0,and avoid the version 8.0,9.0; Upgrade redhat jboss_enterprise_application_platform to a higher version than 6.0.0,6.4.0,7.1,and avoid the version 6.0.0,6.4.0,7.1; Upgrade redhat openshift_container_platform to a higher version than 4.1,3.11,and avoid the version 4.1,3.11; Upgrade netapp e-series_santricity_os_controller to a higher version than 11.60.3,and avoid the version [11.0.0,11.60.3]; Upgrade netapp e-series_santricity_web_services_proxy to a higher version than -; Upgrade netapp oncommand_shift to a higher version than -; Upgrade netapp snapcenter to a higher version than -