https://bugzilla.redhat.com/show_bug.cgi?id=1538332
--- Comment #11 from Doran Moppert <dmoppert(a)redhat.com> ---
Statement:
JBoss EAP 7.x only uses the vulnerable Jackson Databind library for marshalling
and unmarshalling of JSON objects passed to JAX-RS webservices. Some advice
about how to remain safe when using JAX-RS webservices on JBoss EAP 7.x is
available here:
https://access.redhat.com/solutions/3279231
This issue affects the versions of jackson-databind (in Satellite 6.0 and 6.1)
and candlepin (which embeds a copy of jackson-databind in Satellite 6.2) as
shipped with Red Hat Satellitw 6.x. However the affected code is NOT used at
this time:
Candlepin currently uses the default type resolution configuration for the
ObjectMappers it creates/uses. Nowhere in candlepin do we enable global
polymorphic deserialization via enableDefaultTyping(...), therefore based on
the documentation sited BZ 1462702 , candlepin should not be affected.
However as the vulnerable software ships with the product we have marked them
as vulnerable to ensure the issue is tracked.
Red Hat Subscription Asset Manager version 1 is now in a reduced support phase
receiving only Critical impact security fixes. This issue has been rated as
having Important security impact and is not currently planned to be addressed
in future updates.
--
You are receiving this mail because:
You are on the CC list for the bug.