This update backports changes from the commons-collections 3.2.2 release
which disable the deserialisation of the functors classes unless the
system property org.apache.commons.collections.enableUnsafeSerialization
is set to true
. This fixes a vulnerability in unsafe applications
deserialising objects from untrusted sources without sanitising the
input data. Classes considered unsafe are: CloneTransformer, ForClosure,
InstantiateFactory, InstantiateTransformer, InvokerTransformer,
PrototypeCloneFactory, PrototypeSerializationFactory and WhileClosure.
Intelligence View
⚡ tsecurity.de Intelligence
DSA-3403 libcommons-collections3-java - security update
This update backports changes from the commons-collections 3.2.2 release which disable the deserialisation of the functors classes unless the system property…
Cyber Threat Intelligence & Forensik
ATT&CK-Navigator · IoC-Radar · Exploit-Belege
Intelligence Digest - bezpłatnie Codziennie najważniejsze wiadomości bezpieczeństwa · można pobrać w każdej chwili
Community Rating & Social Proof
⭐ Leser-Wertung
Czy ta strona była pomocna?