Jackson Deserializer security vulnerability via default typing (CVE-2017-7525)

[ayound]

I have send email to info@fasterxml.com

EDIT: (23-Apr-2024)

Fix in:

• 2.7.9.1
• 2.8.9
• 2.9.0 and all later 2.x releases

[cowtowncoder]

I have received this and am investigating possible patch. Problem is quite specific, but some aspects are more general.

[cowtowncoder]

Fixed in 2.7, 2.8 and master (to the best of my knowledge): will be in 2.8.9 and 2.7.9.1, as well as 2.9.0.pr3.

[Viyond]

nice~

[ayound]

when do you want to release 2.7.10,2.8.9 and 2.9.0.pr3?

[JoyChou93]

when do you want to release 2.7.10,2.8.9 and 2.9.0.pr3?

[OneSourceCat]

I don't think blacklist is a good mechanism to prevent this issue, because there are other Java Deserialized Gadgets or ClassLoaders can arise this problem including com.sun.org.apache.xalan which is in your list.