Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

javassist.bytecode.ConstPool allows too many items #423

Closed
chibash opened this issue Aug 11, 2022 · 0 comments
Closed

javassist.bytecode.ConstPool allows too many items #423

chibash opened this issue Aug 11, 2022 · 0 comments

Comments

@chibash
Copy link
Member

chibash commented Aug 11, 2022

The number of constant pool items in a class file must be less than 0x10000 (short integer), but the ConstPool class allows a client program to add more items than that. Omer Kaspi from JFrog Security Research via his manager informed me that this could be vulnerability. Although we could not find any realistic attacking scenarios and a risk of this "vulnerability" is very low, I have fixed this problem and released a fixed version as 3.29.1-GA. This version is already available from maven.

chibash added a commit that referenced this issue Aug 11, 2022
@chibash chibash closed this as completed Aug 11, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant