Security Vulnerabilities - 2.9.8

[paragjpatel1985]

jackson-databind is vulnerable to Remote Code Execution (RCE). The createBeanDeserializer() function in the BeanDeserializerFactory class allows untrusted Java objects to be deserialized. A remote attacker can exploit this by uploading a malicious serialized object that will result in RCE if the application attempts to deserialize it.

https://adamcaudill.com/2017/10/04/exploiting-jackson-rce-cve-2017-7525/

[cowtowncoder]

@paragjpatel1985

Article seems to describe a well-known vulnerability that has been blocked (issue #1599).
But if you think there is another one, I would need a reproduction here (or sent to info at fasterxml dot com).

[paragjpatel1985]

The solution in 1599 is a blacklist approach. This wouldn't cover all scenarios and therefore is vulnerable.

[cowtowncoder]

@paragjpatel1985 The question of alternative handling (ability to whitelist) is tackled via #2195.
In future please explain clearly what you are reporting or requesting; or for general discussion use google groups (https://groups.google.com/forum/#!forum/jackson-user).