https://bugzilla.redhat.com/show_bug.cgi?id=1291292
Jason Shepherd <jshepherd(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Priority|high |medium
Severity|high |medium
--- Comment #12 from Jason Shepherd <jshepherd(a)redhat.com> ---
You need to have deployed a JMS publisher, or subscriber which accepts JMS
Object Message to be vulnerable to this flaw. Also, in order to connect to a
HornetQ JMS server in EAP, a username, and password needs to be provided.
However if you do deploy a JMS publisher, and subscriber, and don't trust the
messages sent to you by your clients, you could work around this issue by
installing a Java agent which restricts the classes which can be deserialized.
This is an article with the recommended approach:
https://access.redhat.com/solutions/2190911
--
You are receiving this mail because:
You are on the CC list for the bug.