https://bugzilla.redhat.com/show_bug.cgi?id=1913874
--- Comment #4 from Przemyslaw Roguski <proguski(a)redhat.com> ---
Mitigation:
The following conditions are needed for an exploit, we recommend avoiding all
if possible:
* Deserialization from sources you do not control
* `enableDefaultTyping()`
* `@JsonTypeInfo using `id.CLASS` or `id.MINIMAL_CLASS`
* avoid: oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS,
org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS,
org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS,
org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS,
org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool,
org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource,
org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource,
org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource,
org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource,
com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource,
com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource
in the classpath
--
You are receiving this mail because:
You are on the CC list for the bug.