https://bugzilla.redhat.com/show_bug.cgi?id=1378613
Bug ID: 1378613
Summary: CVE-2016-7050 SerializableProvider in RESTEasy 3
before 3.0.15.Final is enabled by default and
deserializes untrusted data
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: high
Priority: high
Assignee: security-response-team(a)redhat.com
Reporter: jshepherd(a)redhat.com
CC: alee(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
mgoldman(a)redhat.com, puntogil(a)libero.it,
weli(a)redhat.com
Under certain conditions it's possible for an attacker to force the use of a
SerializableProvider to parse a request in RESTEasy. An attacker can use this
flaw to lauch a remote code execution attack.
--
You are receiving this mail because:
You are on the CC list for the bug.