https://bugzilla.redhat.com/show_bug.cgi?id=1848962
--- Comment #3 from Chess Hazlett <chazlett(a)redhat.com> ---
Mitigation:
The following conditions are needed for an exploit, we recommend avoiding all
if possible:
* Deserialization from sources you do not control
* enableDefaultTyping()
* @JsonTypeInfo using id.CLASS or id.MINIMAL_CLASS
* com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool in classpath
--
You are receiving this mail because:
You are on the CC list for the bug.