54
Jackson-databind and Default Typing Vulnerabilities
source link: https://javachannel.org/posts/jackson-databind-and-default-typing-vulnerabilities/
Go to the source link to view the article. You can view the picture content, updated content and better typesetting reading experience. If the link is broken, please click the button below to view the snapshot at that time.
Today, GitHub sent out security notices to owners of projects using old jackson-databind versions (older than 2.8.11.1 and 2.9.5). These notices pertain to this issue. I have talked about its relevance before on IRC, but since it is getting more attention now, I will describe it here again. The “bug” comes from using t
Recommend
About Joyk
Aggregate valuable and interesting links.
Joyk means Joy of geeK