https://bugzilla.redhat.com/show_bug.cgi?id=1898907
Jonathan Christison <jochrist(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Comment|18 |updated
--- Comment #18 has been edited ---
Marking Red Hat JBoss Fuse 6, Red Hat Fuse 7, Red Hat Intergration Camel K as
Moderate, although these products use vulnerable versions of XStream through
the camel-xstream component
https://access.redhat.com/documentation/en-us/red_hat_jboss_fuse/6.3/html...
Camel provides an extended default deny list with
`org.apache.camel.xstream.permissions`, the default being
`-,java.lang.,java.util.`, for this reason the attack complexity is
significantly increased as this deny list is out of the attackers control.
Users overriding the org.apache.camel.xstream.permissions for unmarshalling of
XML should ensure either both `-javax.imageio.ImageIO.` and
`-java.lang.ProcessBuilder.` are explicitly present or all classes are denied
by default eg. `-*,com.misc.mypacakge.myclass`.
--
You are receiving this mail because:
You are on the CC list for the bug.