[
https://issues.apache.org/jira/browse/RATIS-2700?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Tsz-wo Sze updated RATIS-2700:
------------------------------
Description:
We should disallow the jdk classes which are subjected to Java deserialization
vulnerabilities.
This is a follow up on RATIS-2659.
was:
We should disallow gadget‑relevant classes in jdk.
This is a follow up on RATIS-2659.
Summary: Add a disallow-list for ObjectInputStream (was: Disallow
gadget‑relevant classes in jdk)
> Add a disallow-list for ObjectInputStream
> -----------------------------------------
>
> Key: RATIS-2700
> URL: https://issues.apache.org/jira/browse/RATIS-2700
> Project: Ratis
> Issue Type: Improvement
> Components: util
> Reporter: Tsz-wo Sze
> Assignee: Tsz-wo Sze
> Priority: Major
> Attachments: screenshot-1.png, screenshot-2.png, screenshot-3.png
>
>
> We should disallow the jdk classes which are subjected to Java
> deserialization vulnerabilities.
> This is a follow up on RATIS-2659.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
