Skip to content

Commit

Permalink
MNSTR-5023 backport security fix from jackson2
Browse files Browse the repository at this point in the history
  • Loading branch information
tkanafa-atlassian committed Apr 20, 2021
1 parent 36338a5 commit 7480e2b
Show file tree
Hide file tree
Showing 2 changed files with 6 additions and 1 deletion.
4 changes: 3 additions & 1 deletion release-notes/VERSION
Original file line number Diff line number Diff line change
Expand Up @@ -67,7 +67,9 @@ One more patch release for 1.9.
* [databind#2462]: Block two more gadget types (commons-configuration/-2, CVE-2019-14892)
* [databind#2469]: Block one more gadget type (xalan2, might be related to CVE-2019-14893)
* [databind#2704]: Block one more gadget type (xalan2, CVE-2020-14062)
* [databind#2765]: Block one more gadget type (org.jsecurity, 2020-14195)
* [databind#2765]: Block one more gadget type (org.jsecurity, CVE-2020-14195)
* [databind#2798]: Block one more gadget type (CVE-2020-24750)


1.9.13 (14-Jul-2013)

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -187,6 +187,9 @@ public class SubTypeValidator
// [databind#2764]: org.jsecurity:
s.add("org.jsecurity.realm.jndi.JndiRealmFactory");

// [databind#2798]: com.pastdev.httpcomponents:
s.add("com.pastdev.httpcomponents.configuration.JndiConfiguration");

DEFAULT_NO_DESER_CLASS_NAMES = Collections.unmodifiableSet(s);
}

Expand Down

0 comments on commit 7480e2b

Please sign in to comment.