https://bugzilla.redhat.com/show_bug.cgi?id=1887257
Bug ID: 1887257
Summary: CVE-2020-26945 mybatis: mishandles deserialization of
object streams which could result in remote code
execution
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: mkaplan(a)redhat.com
CC: aileenc(a)redhat.com, bibryam(a)redhat.com,
chazlett(a)redhat.com, drieden(a)redhat.com,
extras-orphan(a)fedoraproject.org, ganandan(a)redhat.com,
ggaughan(a)redhat.com, gmalinko(a)redhat.com,
hbraun(a)redhat.com, janstey(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jochrist(a)redhat.com, jwon(a)redhat.com,
pantinor(a)redhat.com, puntogil(a)libero.it
Target Milestone: ---
Classification: Other
MyBatis before 3.5.6 mishandles deserialization of object streams.
References:
https://github.com/mybatis/mybatis-3/compare/mybatis-3.5.5...mybatis-3.5.6
https://github.com/mybatis/mybatis-3/pull/2079
--
You are receiving this mail because:
You are on the CC list for the bug.