https://bugzilla.redhat.com/show_bug.cgi?id=1755831
--- Comment #5 from Doran Moppert <dmoppert(a)redhat.com> ---
Mitigation:
This vulnerability relies on com.zaxxer.hikari.HikariDataSource being present
in the application's ClassPath. Hikari is not packaged as an RPM for Red Hat
Enterprise Linux or Red Hat Software Collections. Applications using
jackson-databind that do not also use com.zaxxer.hikari are not impacted by
this vulnerability.
A mitigation to this class of problem in jackson-databind is to not trigger
polymorphic desrialization globally by using:
objectMapper.enableDefaultTyping() and rather use @JsonTypeInfo on the class
property to explicitly define the type information. For more information on
this issue please refer to
https://www.github.com/mbechler/marshalsec/blob/master/marshalsec.pdf?raw...
--
You are receiving this mail because:
You are on the CC list for the bug.