StackRadar

CVE-2017-17485

Critical

Advisory

Published 18 Oct 2018In the index since 6 Sept 2026
Severity
Critical
worst across findings
CVSS
9.8
base score, highest
EPSS
0.497
99th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
79
of 17,781 indexed, latest versions
Container images
86
deployed by those charts
Fix available
1 of 1
affected package

jackson-databind vulnerable to remote code execution due to incorrect deserialization and blocklist bypass

Carried by container images the latest versions of 79 of 17,781 indexed charts deploy, on 86 images.

Affected packageAffected versionsFixed inImages
jackson-databindmaven2.0.5, 2.2.3, 2.3.0, 2.3.3+19 more2.7.9.2, 2.8.11, 2.9.486
OSV records
GHSA-rfx6-vp9g-rh7v

Charts affected

79 by stars
ChartLatestAffected imagesRadar Score
sparkmicrosoft1.0.42 of 3See more

spark microsoft 1.0.4

2 of the 3 container images this version deploys carry CVE-2017-17485.

Container imageDigestPackageFixed in
dbanda/livy:0.80ca125e68e53
jackson-databind@2.4.0
2.7.9.2
dbanda/spark:2.4.6d0e6367876ae
jackson-databind@2.4.0
2.7.9.2

Open the chart page →

13,738
solrpreferred-aiVerified publisher3.2.01 of 3See more

solr preferred-ai 3.2.0

1 of the 3 container images this version deploys carry CVE-2017-17485.

Container imageDigestPackageFixed in
library/solr:8.7.0d124efd81fbb
jackson-databind@2.4.0
2.7.9.2

Open the chart page →

6,048
hadoopbigdata-chartsVerified publisher1.0.11 of 2See more

hadoop bigdata-charts 1.0.1

1 of the 2 container images this version deploys carry CVE-2017-17485.

Container imageDigestPackageFixed in
5200710/hadoop:3.2.3-java8092d3088a5fb
jackson-databind@2.4.0
2.7.9.2

Open the chart page →

12,111
jira-softwaremoxVerified publisher2.7.11 of 3See more

jira-software mox 2.7.1

1 of the 3 container images this version deploys carry CVE-2017-17485.

Container imageDigestPackageFixed in
atlassian/jira-software:9.7.264a75aa4ec4e
jackson-databind@2.3.3
2.7.9.2

Open the chart page →

8,636
druidwiremindVerified publisher1.22.11 of 3See more

druid wiremind 1.22.1

1 of the 3 container images this version deploys carry CVE-2017-17485.

Container imageDigestPackageFixed in
apache/druid:29.0.10cef139b6bf1
jackson-databind@2.4.0
2.7.9.2

Open the chart page →

7,930
hivebigdata-chartsVerified publisher0.1.81 of 1See more

hive bigdata-charts 0.1.8

1 of the 1 container images this version deploys carry CVE-2017-17485.

Container imageDigestPackageFixed in
5200710/hive:3.1.3-postgresql-metastoree34ab066d2ed
jackson-databind@2.6.7.3
2.7.9.2

Open the chart page →

7,166
hdfsdmwm-bigdataVerified publisher1.0.11 of 2See more

hdfs dmwm-bigdata 1.0.1

1 of the 2 container images this version deploys carry CVE-2017-17485.

Container imageDigestPackageFixed in
gradiant/hdfs:3.2.2e3bf364fe713
jackson-databind@2.4.0
2.7.9.2

Open the chart page →

7,948
hivedmwm-bigdataVerified publisher0.1.63 of 5See more

hive dmwm-bigdata 0.1.6

3 of the 5 container images this version deploys carry CVE-2017-17485.

Container imageDigestPackageFixed in
bde2020/hive:2.3.2-postgresql-metastore620267768985
jackson-databind@2.6.5
2.7.9.2
gradiant/hdfs:2.7.73b28784ba41f
jackson-databind@2.4.0
2.7.9.2
gradiant/hive:2.3.2-postgresql-metastoreaae4f8a21f8b
jackson-databind@2.2.3
2.7.9.2

Open the chart page →

20,837
hive-metastoreheva-helm-chartsVerified publisher0.2.01 of 2See more

hive-metastore heva-helm-charts 0.2.0

1 of the 2 container images this version deploys carry CVE-2017-17485.

Container imageDigestPackageFixed in
sslhep/hive-metastore:3.1.39e80af083079
jackson-databind@2.4.0
2.7.9.2

Open the chart page →

7,335
hive-metastoreslamdev0.0.51 of 2See more

hive-metastore slamdev 0.0.5

1 of the 2 container images this version deploys carry CVE-2017-17485.

Container imageDigestPackageFixed in
slamdev/apache-hive:2.3.9-2.10.1b4b029c9b15f
jackson-databind@2.4.0
2.7.9.2

Open the chart page →

8,198
hadoopcloudnativeapp1.1.01 of 1See more

hadoop cloudnativeapp 1.1.0

1 of the 1 container images this version deploys carry CVE-2017-17485.

Container imageDigestPackageFixed in
danisla/hadoop:2.9.0255ba2dd739b
jackson-databind@2.4.0
2.7.9.2

Open the chart page →

5,772
ignitecloudnativeapp1.0.01 of 1See more

ignite cloudnativeapp 1.0.0

1 of the 1 container images this version deploys carry CVE-2017-17485.

Container imageDigestPackageFixed in
apacheignite/ignite:2.7.0d7deab68b8fa
jackson-databind@2.4.0
2.7.9.2

Open the chart page →

7,891
hbasedmwm-bigdataVerified publisher0.1.62 of 5See more

hbase dmwm-bigdata 0.1.6

2 of the 5 container images this version deploys carry CVE-2017-17485.

Container imageDigestPackageFixed in
gradiant/hbase-base:2.0.1a1ee6de94c04
jackson-databind@2.4.0
2.7.9.2
gradiant/hdfs:2.7.73b28784ba41f
jackson-databind@2.4.0
2.7.9.2

Open the chart page →

13,392
hive-metastoredmwm-bigdataVerified publisher0.1.31 of 2See more

hive-metastore dmwm-bigdata 0.1.3

1 of the 2 container images this version deploys carry CVE-2017-17485.

Container imageDigestPackageFixed in
bde2020/hive:2.3.2-postgresql-metastore620267768985
jackson-databind@2.6.5
2.7.9.2

Open the chart page →

6,882
opentsdbdmwm-bigdataVerified publisher0.1.72 of 6See more

opentsdb dmwm-bigdata 0.1.7

2 of the 6 container images this version deploys carry CVE-2017-17485.

Container imageDigestPackageFixed in
gradiant/hbase-base:2.0.1a1ee6de94c04
jackson-databind@2.4.0
2.7.9.2
gradiant/hdfs:2.7.73b28784ba41f
jackson-databind@2.4.0
2.7.9.2

Open the chart page →

17,511
hbasegradiant-bigdataVerified publisher0.1.62 of 5See more

hbase gradiant-bigdata 0.1.6

2 of the 5 container images this version deploys carry CVE-2017-17485.

Container imageDigestPackageFixed in
gradiant/hbase-base:2.0.1a1ee6de94c04
jackson-databind@2.4.0
2.7.9.2
gradiant/hdfs:2.7.73b28784ba41f
jackson-databind@2.4.0
2.7.9.2

Open the chart page →

13,392
stormgresearch1.2.01 of 3See more

storm gresearch 1.2.0

1 of the 3 container images this version deploys carry CVE-2017-17485.

Container imageDigestPackageFixed in
library/storm:2.4.0bd5d420506d6
jackson-databind@2.4.0
2.7.9.2

Open the chart page →

6,165
gridgaingridgainOfficialVerified publisher1.0.61 of 1See more

gridgain gridgain 1.0.6

1 of the 1 container images this version deploys carry CVE-2017-17485.

Container imageDigestPackageFixed in
gridgain/community:8.9.11d32d182a0e6a
jackson-databind@2.4.0
2.7.9.2

Open the chart page →

4,679
kokukokuVerified publisher1.0.01 of 7See more

koku koku 1.0.0

1 of the 7 container images this version deploys carry CVE-2017-17485.

Container imageDigestPackageFixed in
public.ecr.aws/v0r6c2e2/hive-metastore:latest794b3bff9510
jackson-databind@2.4.0
2.7.9.2

Open the chart page →

12,019
hadoopmiuler1.2.21 of 1See more

hadoop miuler 1.2.2

1 of the 1 container images this version deploys carry CVE-2017-17485.

Container imageDigestPackageFixed in
danisla/hadoop:2.9.0255ba2dd739b
jackson-databind@2.4.0
2.7.9.2

Open the chart page →

5,772
starwhalestarwhaleVerified publisher0.6.151 of 4See more

starwhale starwhale 0.6.15

1 of the 4 container images this version deploys carry CVE-2017-17485.

Container imageDigestPackageFixed in
ghcr.io/star-whale/server:0.6.158368359c8dd0
jackson-databind@2.4.0
2.7.9.2

Open the chart page →

13,486
ckanstatcan0.0.351 of 8See more

ckan statcan 0.0.35

1 of the 8 container images this version deploys carry CVE-2017-17485.

Container imageDigestPackageFixed in
library/solr:8.11.18c5f7881cebb
jackson-databind@2.4.0
2.7.9.2

Open the chart page →

24,930
graylogt3n1.0.01 of 3See more

graylog t3n 1.0.0

1 of the 3 container images this version deploys carry CVE-2017-17485.

Container imageDigestPackageFixed in
graylog2/server:2.4.3-38ff28c66e6c1
jackson-databind@2.8.9
2.8.11

Open the chart page →

8,063
chart-app-vidapp-vid-chartVerified publisher0.0.71 of 2See more

chart-app-vid app-vid-chart 0.0.7

1 of the 2 container images this version deploys carry CVE-2017-17485.

Container imageDigestPackageFixed in
fimperato/sparkvid-api:1.0.5-RELEASE604012b77841
jackson-databind@2.4.0
2.7.9.2

Open the chart page →

8,866
authorizationassist-iot-authorisation0.1.01 of 2See more

authorization assist-iot-authorisation 0.1.0

1 of the 2 container images this version deploys carry CVE-2017-17485.

Container imageDigestPackageFixed in
assistiot/authorization_svr:latestdb9361dad79b
jackson-databind@2.6.0
2.7.9.2

Open the chart page →

5,537
automatedconfigurationassist-iot-automated-configuration1.0.01 of 5See more

automatedconfiguration assist-iot-automated-configuration 1.0.0

1 of the 5 container images this version deploys carry CVE-2017-17485.

Container imageDigestPackageFixed in
assistiot/automated_configuration:latest23f195a7a26a
jackson-databind@2.2.3
2.7.9.2

Open the chart page →

14,728
event-store-servicechoerodon0.8.01 of 2See more

event-store-service choerodon 0.8.0

1 of the 2 container images this version deploys carry CVE-2017-17485.

Container imageDigestPackageFixed in
choerodon/event-store-service:0.8.03c94c97f6f69
jackson-databind@2.8.8
2.8.11

Open the chart page →

9,808
cosbenchcloudnativeapp1.0.11 of 1See more

cosbench cloudnativeapp 1.0.1

1 of the 1 container images this version deploys carry CVE-2017-17485.

Container imageDigestPackageFixed in
zenko/zenko-cosbench:0.0.6386a1f48ec0e
jackson-databind@2.5.3
2.7.9.2

Open the chart page →

4,906
hazelcastcloudnativeapp1.3.11 of 1See more

hazelcast cloudnativeapp 1.3.1

1 of the 1 container images this version deploys carry CVE-2017-17485.

Container imageDigestPackageFixed in
hazelcast/hazelcast:3.11.2ca7d5589744f
jackson-databind@2.8.7
2.8.11

Open the chart page →

4,982
hazelcast-jetcloudnativeapp1.1.01 of 1See more

hazelcast-jet cloudnativeapp 1.1.0

1 of the 1 container images this version deploys carry CVE-2017-17485.

Container imageDigestPackageFixed in
hazelcast/hazelcast-jet:3.0df495e64ea65
jackson-databind@2.8.7
2.8.11

Open the chart page →

5,326
metabasecloudnativeapp0.5.01 of 1See more

metabase cloudnativeapp 0.5.0

1 of the 1 container images this version deploys carry CVE-2017-17485.

Container imageDigestPackageFixed in
metabase/metabase:v0.31.2ffb2dccacefc
jackson-databind@2.5.3
2.7.9.2

Open the chart page →

4,601
prestocloudnativeapp0.1.11 of 1See more

presto cloudnativeapp 0.1.1

1 of the 1 container images this version deploys carry CVE-2017-17485.

Container imageDigestPackageFixed in
bivas/presto:0.19605545994f806
jackson-databind@2.8.1
2.8.11

Open the chart page →

7,226
prometheus-cloudwatch-exportercloudnativeapp0.4.51 of 1See more

prometheus-cloudwatch-exporter cloudnativeapp 0.4.5

1 of the 1 container images this version deploys carry CVE-2017-17485.

Container imageDigestPackageFixed in
prom/cloudwatch-exporter:cloudwatch_exporter-0.5.0923705b2ae77
jackson-databind@2.6.6
2.7.9.2

Open the chart page →

2,629
riemanncloudnativeapp0.1.21 of 1See more

riemann cloudnativeapp 0.1.2

1 of the 1 container images this version deploys carry CVE-2017-17485.

Container imageDigestPackageFixed in
raykrueger/riemann:0.2.14c8baf3de57bb
jackson-databind@2.5.4
2.7.9.2

Open the chart page →

6,497
rundeckcloudnativeapp0.1.01 of 2See more

rundeck cloudnativeapp 0.1.0

1 of the 2 container images this version deploys carry CVE-2017-17485.

Container imageDigestPackageFixed in
rundeck/rundeck:3.0.16b13e8059ad72
jackson-databind@2.3.3
2.7.9.2

Open the chart page →

23,665
spark-history-servercloudnativeapp1.0.01 of 3See more

spark-history-server cloudnativeapp 1.0.0

1 of the 3 container images this version deploys carry CVE-2017-17485.

Container imageDigestPackageFixed in
lightbend/spark-history-server:2.4.00bedf37f428a
jackson-databind@2.4.0
2.7.9.2

Open the chart page →

14,066
apache-ranger-admindata-platform-stableVerified publisher0.2.01 of 2See more

apache-ranger-admin data-platform-stable 0.2.0

1 of the 2 container images this version deploys carry CVE-2017-17485.

Container imageDigestPackageFixed in
egdsandaru/apache-ranger-admin:1.0.0681baa1926f4
jackson-databind@2.4.0
2.7.9.2

Open the chart page →

8,245
spark-standalonedmwm-bigdataVerified publisher0.1.01 of 2See more

spark-standalone dmwm-bigdata 0.1.0

1 of the 2 container images this version deploys carry CVE-2017-17485.

Container imageDigestPackageFixed in
gradiant/spark:2.4.4-python-alpine97657d56e927
jackson-databind@2.6.7.1
2.7.9.2

Open the chart page →

6,147
spark-shuffleduyet0.2.01 of 1See more

spark-shuffle duyet 0.2.0

1 of the 1 container images this version deploys carry CVE-2017-17485.

Container imageDigestPackageFixed in
snappydatainc/spark-shuffle:v2.2.0-kubernetes-0.5.1fd4b2070466f
jackson-databind@2.6.5
2.7.9.2

Open the chart page →

5,639
rundeckdwardu-helm-charts0.3.41 of 2See more

rundeck dwardu-helm-charts 0.3.4

1 of the 2 container images this version deploys carry CVE-2017-17485.

Container imageDigestPackageFixed in
rundeck/rundeck:3.2.74d64fe56f767
jackson-databind@2.3.3
2.7.9.2

Open the chart page →

19,802
my-chartfleet-web-app0.1.02 of 6See more

my-chart fleet-web-app 0.1.0

2 of the 6 container images this version deploys carry CVE-2017-17485.

Container imageDigestPackageFixed in
richardchesterwood/k8s-fleetman-api-gateway:release2518f946b9f05
jackson-databind@2.8.7
2.8.11
richardchesterwood/k8s-fleetman-position-tracker:release336c43961214c
jackson-databind@2.8.1
2.8.11

Open the chart page →

24,296
accumulogaffer2.2.11 of 4See more

accumulo gaffer 2.2.1

1 of the 4 container images this version deploys carry CVE-2017-17485.

Container imageDigestPackageFixed in
gchq/accumulo:2.0.1c460bb587d6d
jackson-databind@2.4.0
2.7.9.2

Open the chart page →

16,892
hdfsgradiant-bigdataVerified publisher0.1.101 of 2See more

hdfs gradiant-bigdata 0.1.10

1 of the 2 container images this version deploys carry CVE-2017-17485.

Container imageDigestPackageFixed in
gradiant/hdfs:2.7.73b28784ba41f
jackson-databind@2.4.0
2.7.9.2

Open the chart page →

7,073
hivegradiant-bigdataVerified publisher0.1.63 of 5See more

hive gradiant-bigdata 0.1.6

3 of the 5 container images this version deploys carry CVE-2017-17485.

Container imageDigestPackageFixed in
bde2020/hive:2.3.2-postgresql-metastore620267768985
jackson-databind@2.6.5
2.7.9.2
gradiant/hdfs:2.7.73b28784ba41f
jackson-databind@2.4.0
2.7.9.2
gradiant/hive:2.3.2-postgresql-metastoreaae4f8a21f8b
jackson-databind@2.2.3
2.7.9.2

Open the chart page →

20,837
hive-metastoregradiant-bigdataVerified publisher0.1.31 of 2See more

hive-metastore gradiant-bigdata 0.1.3

1 of the 2 container images this version deploys carry CVE-2017-17485.

Container imageDigestPackageFixed in
bde2020/hive:2.3.2-postgresql-metastore620267768985
jackson-databind@2.6.5
2.7.9.2

Open the chart page →

6,882
opentsdbgradiant-bigdataVerified publisher0.1.72 of 6See more

opentsdb gradiant-bigdata 0.1.7

2 of the 6 container images this version deploys carry CVE-2017-17485.

Container imageDigestPackageFixed in
gradiant/hbase-base:2.0.1a1ee6de94c04
jackson-databind@2.4.0
2.7.9.2
gradiant/hdfs:2.7.73b28784ba41f
jackson-databind@2.4.0
2.7.9.2

Open the chart page →

17,511
spark-standalonegradiant-bigdataVerified publisher0.1.01 of 2See more

spark-standalone gradiant-bigdata 0.1.0

1 of the 2 container images this version deploys carry CVE-2017-17485.

Container imageDigestPackageFixed in
gradiant/spark:2.4.4-python-alpine97657d56e927
jackson-databind@2.6.7.1
2.7.9.2

Open the chart page →

6,147
ubooquityhalkeye0.1.11 of 1See more

ubooquity halkeye 0.1.1

1 of the 1 container images this version deploys carry CVE-2017-17485.

Container imageDigestPackageFixed in
linuxserver/ubooquity:2.1.2-ls369932d6759112
jackson-databind@2.8.4
2.8.11

Open the chart page →

4,303
hapi-fhirhapi-fhirVerified publisher0.1.01 of 1See more

hapi-fhir hapi-fhir 0.1.0

1 of the 1 container images this version deploys carry CVE-2017-17485.

Container imageDigestPackageFixed in
polyakov/hapi-fhir-jpaserver-example:latestdbcef69146b8
jackson-databind@2.3.3
2.7.9.2

Open the chart page →

6,362
hazelcast-jethazelcastVerified publisher1.17.11 of 1See more

hazelcast-jet hazelcast 1.17.1

1 of the 1 container images this version deploys carry CVE-2017-17485.

Container imageDigestPackageFixed in
hazelcast/hazelcast-jet:4.5.3a825ecbe9fda
jackson-databind@2.4.0
2.7.9.2

Open the chart page →

6,102

Container images carrying it

86 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ncsa/datawolf:4.7.0af6649d59150
jackson-databind@2.0.5
2.7.9.2
1
ncsapolyglot/converters-avconv:latestc44b22eb58bb
jackson-databind@2.2.3
2.7.9.2
1
ncsapolyglot/converters-ebook-convert:latest438d82cdbdb5
jackson-databind@2.2.3
2.7.9.2
1
ncsapolyglot/converters-ffmpeg:latest48c852c1204b
jackson-databind@2.2.3
2.7.9.2
1
ncsapolyglot/converters-flac:latest072cf5bc6f99
jackson-databind@2.2.3
2.7.9.2
1
ncsapolyglot/converters-gdal:latestf746049515c1
jackson-databind@2.2.3
2.7.9.2
1
ncsapolyglot/converters-ghostscript:latestf350da56dd55
jackson-databind@2.2.3
2.7.9.2
1
ncsapolyglot/converters-htmldoc:latest317dd9e56922
jackson-databind@2.2.3
2.7.9.2
1
ncsapolyglot/converters-imagemagick:latestd244ea8c32ac
jackson-databind@2.2.3
2.7.9.2
1
ncsapolyglot/converters-openjpeg:latest2ba4af461d51
jackson-databind@2.2.3
2.7.9.2
1
ncsapolyglot/converters-txt2html:latest30ee96508c0b
jackson-databind@2.2.3
2.7.9.2
1
ncsapolyglot/converters-unoconv:latest1d9cebe3022b
jackson-databind@2.2.3
2.7.9.2
1
ncsapolyglot/converters-zip:latestf889fe30e2c7
jackson-databind@2.2.3
2.7.9.2
1
ncsapolyglot/polyglot:2.4.097a8c01c076e
jackson-databind@2.2.3
2.7.9.2
1
omecproject/onos-progran:1.0.05715e5648aa0
jackson-databind@2.7.3
2.7.9.2
1
polyakov/hapi-fhir-jpaserver-example:latestdbcef69146b8
jackson-databind@2.3.3
2.7.9.2
1
prom/cloudwatch-exporter:cloudwatch_exporter-0.5.0923705b2ae77
jackson-databind@2.6.6
2.7.9.2
1
raykrueger/riemann:0.2.14c8baf3de57bb
jackson-databind@2.5.4
2.7.9.2
1
richardchesterwood/k8s-fleetman-api-gateway:release2518f946b9f05
jackson-databind@2.8.7
2.8.11
1
richardchesterwood/k8s-fleetman-position-tracker:release336c43961214c
jackson-databind@2.8.1
2.8.11
1
rundeck/rundeck:3.2.74d64fe56f767
jackson-databind@2.3.3
2.7.9.2
1
rundeck/rundeck:3.0.16b13e8059ad72
jackson-databind@2.3.3
2.7.9.2
1
slamdev/apache-hive:2.3.9-2.10.1b4b029c9b15f
jackson-databind@2.4.0
2.7.9.2
1
snappydatainc/spark-shuffle:v2.2.0-kubernetes-0.5.1fd4b2070466f
jackson-databind@2.6.5
2.7.9.2
1
sslhep/hive-metastore:3.1.39e80af083079
jackson-databind@2.4.0
2.7.9.2
1
trinodb/trino:45038c6f24ab1a4
jackson-databind@2.4.0
2.7.9.2
1
trinodb/trino:405ee80ab5eeab2
jackson-databind@2.4.0
2.7.9.2
1
woojoong/wowza:latestec230db19652
jackson-databind@2.9.0
2.9.4
1
xetusoss/archiva:v2.2.588f25242b9ee
jackson-databind@2.3.0
2.7.9.2
1
zenko/zenko-cosbench:0.0.6386a1f48ec0e
jackson-databind@2.5.3
2.7.9.2
1
ghcr.io/fleeksoft/hbase/hbase-base:2.4.13.2c144bdd688d7
jackson-databind@2.4.0
2.7.9.2
1
ghcr.io/fleeksoft/hbase/hdfs:3.3.3.2ac62269785ac
jackson-databind@2.4.0
2.7.9.2
1
ghcr.io/melodyyangaws/hive-metastore:3.0.0e949b0f733f0
jackson-databind@2.4.0
2.7.9.2
1
ghcr.io/star-whale/server:0.6.158368359c8dd0
jackson-databind@2.4.0
2.7.9.2
1
ghcr.io/wbstack/queryservice:0.3.6_0.6b83b5b81d4b6
jackson-databind@2.6.7
2.7.9.2
1
public.ecr.aws/v0r6c2e2/hive-metastore:latest794b3bff9510
jackson-databind@2.4.0
2.7.9.2
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.