https://bugzilla.redhat.com/show_bug.cgi?id=1462702
--- Comment #57 from Andrej Nemec <anemec(a)redhat.com> ---
Statement:
This issue affects the versions of jackson-databind (in Satellite 6.0 and 6.1)
and candlepin (which embeds a copy of jackson-databind in Satellite 6.2) as
shipped with Red Hat Satellite 6.x. However the affected code is NOT used at
this time:
Candlepin currently uses the default type resolution configuration for the
ObjectMappers it creates/uses. Nowhere in candlepin do we enable global
polymorphic deserialization via enableDefaultTyping(...), therefore based on
the documentation sited BZ 1462702 , candlepin should not be affected.
However as the vulnerable software ships with the product we have marked them
as vulnerable to ensure the issue is tracked.
JBoss EAP 7.x only uses the vulnerable Jackson Databind library for marshalling
and unmarshalling of JSON objects passed to JAX-RS webservices. Some advise
about how to remain safe when using JAX-RS webservices on JBoss EAP 7.x is
available here:
https://access.redhat.com/solutions/3279231
Although JBoss Fuse ships the vulnerable version of jackson-databind, it does
not call on enableDefaultTyping() for any polymorphic deserialization
operations which is the root cause of this vulnerability. We have raised a Jira
tracker to ensure that jackson-databind will be upgraded for Fuse 7.0, however
due to feasibility issues jackson-databind cannot be upgraded in JBoss Fuse
6.3.
--
You are receiving this mail because:
You are on the CC list for the bug.