https://bugzilla.redhat.com/show_bug.cgi?id=1725807
--- Doc Text *updated* by Eric Christensen <sparks(a)redhat.com> ---
A flaw was discovered in FasterXML jackson-databind in versions prior to 2.9.9. The
vulnerability would permit polymorphic deserialization of malicious objects using the
logback-core gadget when used in conjunction with polymorphic type handling methods such
as `enableDefaultTyping()` or when @JsonTypeInfo is using `Id.CLASS` or `Id.MINIMAL_CLASS`
or in any other way which ObjectMapper.readValue might instantiate objects from unsafe
sources. Depending on the classpath content, remote code execution may be possible.
--
You are receiving this mail because:
You are on the CC list for the bug.