Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

A security Bug. #2853

Closed
KinofRikin opened this issue Sep 16, 2020 · 2 comments
Closed

A security Bug. #2853

KinofRikin opened this issue Sep 16, 2020 · 2 comments

Comments

@KinofRikin
Copy link

Hello, buddy. I found a JRE dependent gadget that can be used for SSRF when deserializing.

I have sent an email to [email protected] for details of the vulnerability.

Thanks.
@KinofRikin KinofRikin added the to-evaluate Issue that has been received but not yet evaluated label Sep 16, 2020
@cowtowncoder
Copy link
Member

@KinofRikin Thank you! I see the email there; will create a placeholder etc. I think it does qualify for CVE, I hope to work on it soon:

https://github.com/FasterXML/jackson/wiki/Jackson-Polymorphic-Deserialization-CVE-Criteria

@cowtowncoder
Copy link
Member

Created #2854 to track this issue.

@cowtowncoder cowtowncoder removed the to-evaluate Issue that has been received but not yet evaluated label Dec 9, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@cowtowncoder @KinofRikin