Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Block one more gadget type (xalan2) #2469

Closed
cowtowncoder opened this issue Sep 20, 2019 · 1 comment
Closed

Block one more gadget type (xalan2) #2469

cowtowncoder opened this issue Sep 20, 2019 · 1 comment
Milestone
2.9.10

Comments

@cowtowncoder
Copy link
Member

cowtowncoder commented Sep 20, 2019 •
edited

Another gadget (*) type report regarding a class of xalan.

Mitre id: not yet allocated
Reporter: @ybhou1993 (via #2462 originally)

  • 2.9.10
  • 2.8.11.5
  • does not affect 2.10.0 and later

(*) See https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 for more on general problem type
@cowtowncoder cowtowncoder mentioned this issue Sep 20, 2019
Closed
@cowtowncoder
Copy link
Member Author

Looks like this one is legit too, following similar pattern of creating JNDI context.

@cowtowncoder cowtowncoder modified the milestones: 2.9,0.pr4, 2.9.10 Sep 20, 2019
martokarski pushed a commit to atlassian/jackson-1 that referenced this issue May 8, 2020
Block one more gadget type (xalan2)
086ce21 
Merged from FasterXML/jackson-databind#2469
@padma81 padma81 mentioned this issue Jul 28, 2020
Closed
@sijie sijie mentioned this issue Jul 28, 2020
Open
This was referenced Dec 26, 2020
Closed
Closed
This was referenced May 10, 2022
Open
Open
@scott-cx scott-cx mentioned this issue Aug 1, 2022
Open
@cxronen cxronen mentioned this issue Sep 20, 2022
Open
@margaritalm margaritalm mentioned this issue Dec 25, 2022
Open
@cxronen cxronen mentioned this issue Apr 13, 2023
Open
@cxronen cxronen mentioned this issue May 25, 2023
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
2.9.10
Development

No branches or pull requests
1 participant
@cowtowncoder