Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Block more JDK gadget types (com.sun.rowset) #1680

Closed
cowtowncoder opened this issue Jun 27, 2017 · 2 comments
Closed

Block more JDK gadget types (com.sun.rowset) #1680

cowtowncoder opened this issue Jun 27, 2017 · 2 comments
Labels
CVE Issues related to public CVEs (security vuln reports)
Milestone
2.8.10

Comments

@cowtowncoder
Copy link
Member

cowtowncoder commented Jun 27, 2017 •
edited
Loading

(note: follow-up on #1599)

Looks like there is at least one other "well-known" type to block besides 9 already added (an impl class for database drivers): com.sun.rowset.JdbcRowSetImpl

Fixed in:

  • 2.9.0 and all later
  • 2.8.10
  • 2.7.9.2
  • 2.6.7.3
@cowtowncoder cowtowncoder added this to the 2.8.10 milestone Jun 30, 2017
@cowtowncoder
Copy link
Member Author

Fixed for 2.8.10, 2.9.0; and if released, 2.7.10 (added post 2.7.9.1).

cowtowncoder added a commit that referenced this issue Jun 30, 2017
@cowtowncoder
Fix #1680
e8f043d
@cowtowncoder cowtowncoder mentioned this issue Aug 6, 2017
Closed
@stevie400 stevie400 mentioned this issue Sep 5, 2017
Merged
@cowtowncoder cowtowncoder mentioned this issue Dec 1, 2017
Closed
@cowtowncoder cowtowncoder added the CVE Issues related to public CVEs (security vuln reports) label Dec 12, 2017
cowtowncoder added a commit that referenced this issue Dec 12, 2017
@cowtowncoder
Add a note wrt #1680
569e36e
This was referenced Jan 19, 2018
Merged
Closed
@cowtowncoder
Copy link
Member Author

For further info: https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062

This was referenced Dec 5, 2018
Open
Open
Open
Closed
Closed
Closed
Open
This was referenced Dec 12, 2018
Open
Open
@mend-bolt-for-github mend-bolt-for-github bot mentioned this issue Dec 19, 2018
Open
@mend-bolt-for-github mend-bolt-for-github bot mentioned this issue Dec 27, 2018
Open
This was referenced Jan 15, 2019
Open
Open
Open
@mend-bolt-for-github mend-bolt-for-github bot mentioned this issue Jan 28, 2019
Closed
This was referenced Feb 4, 2019
Open
Open
Open
This was referenced Aug 8, 2019
Closed
Closed
Closed
Closed
Closed
Closed
Closed
Closed
Closed
Closed
Closed
Closed
Closed
Closed
Closed
Closed
Closed
Closed
Closed
This was referenced Aug 16, 2019
Closed
Closed
Closed
This was referenced Aug 26, 2019
Closed
Closed
Closed
Closed
Open
@cowtowncoder cowtowncoder changed the title Blacklist couple more types for deserialization Block more JDK gadget types (com.sun.rowset) Sep 12, 2019
This was referenced May 10, 2022
Open
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
CVE Issues related to public CVEs (security vuln reports)
Projects
None yet
Milestone
2.8.10
Development

No branches or pull requests
1 participant
@cowtowncoder