--- Comment #5 from Jason Shepherd <jshepherd(a)redhat.com> ---
We agree with Apache's assessment that this does not represent a valid
vulnerability in the Commons File Upload library. We have previously written
about Java deserialization flaws in a Security Blog post, and encourage anyone
interested in this flaw to read more our stance here:
We encourage customers developing applications in Java to assess their use of
Java serialization, to ensure they add authentication, and authorization to
endpoints which accept data for deserialization. If that application accepts
untrusted data for deserialization, and the Commons File Upload library is
available on the classpath, it could be exposed to this issue. We consider the
vulnerability to be with deseriazliation of untrusted data.
You are receiving this mail because:
You are on the CC list for the bug.