https://bugzilla.redhat.com/show_bug.cgi?id=1966735
Jonathan Christison <jochrist(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Flags|needinfo?(jochrist(a)redhat.c |
|om) |
--- Comment #9 from Jonathan Christison <jochrist(a)redhat.com> ---
Marking Red Hat JBoss Fuse 6, Red Hat Fuse 7 and Red Hat Intergration Camel K
as Moderate, although these products use vulnerable versions of XStream through
the camel-xstream component
https://access.redhat.com/documentation/en-us/red_hat_jboss_fuse/6.3/html...
Camel provides an extended default deny list with
`org.apache.camel.xstream.permissions`, the default being
`-,java.lang.,java.util.`, for this reason the attack complexity is
significantly increased as this deny list is out of the attackers control.
Users overriding the org.apache.camel.xstream.permissions for unmarshalling of
XML should ensure all classes are denied by default eg.
`-*,com.misc.mypacakge.myclass`.
--
You are receiving this mail because:
You are on the CC list for the bug.