https://bugzilla.redhat.com/show_bug.cgi?id=1462702
--- Comment #36 from Doran Moppert <dmoppert(a)redhat.com> ---
Mitigation:
Mitigation to this problem is to not trigger polymorphic desrialization
globally by using: objectMapper.enableDefaultTyping() and rather use
@JsonTypeInfo on the class property to explicitly define the type information.
For more information on this issue please refer to
https://www.github.com/mbechler/marshalsec/blob/master/marshalsec.pdf?raw...
--
You are receiving this mail because:
You are on the CC list for the bug.