https://bugzilla.redhat.com/show_bug.cgi?id=1291292
--- Comment #22 from Andrej Nemec <anemec(a)redhat.com> ---
Mitigation:
If you do deploy a JMS publisher, and subscriber, and don't trust the messages
sent to you by your clients, you could mitigate this issue by installing a Java
agent which restricts the classes which can be deserialized. This is an article
with the recommended approach:
https://access.redhat.com/solutions/2190911
You could also mitigate this issue using the features of the Java Virtual
Machine added in JEP 290:
http://openjdk.java.net/jeps/290
--
You are receiving this mail because:
You are on the CC list for the bug.