[COLLECTIONS-580] Arbitrary remote code execution with InvokerTransformer - ASF JIRA
With InvokerTransformer serializable collections can be build that execute arbitrary Java code. sun.reflect.annotation.AnnotationInvocationHandler#readObject invokes #entrySet and #get on a deserialized collection. If you have an endpoint that accepts serialized Java objects (JMX, RMI, remote EJB, ...) you can combine the two to create arbitrary remote code execution vulnerability. I don't know of
1
リリース、障害情報などのサービスのお知らせ
最新の人気エントリーの配信
処理を実行中です
j次のブックマーク
k前のブックマーク
lあとで読む
eコメント一覧を開く
oページを開く
[AMQ-6222] Message content can be cleared by mistake when isReduceMemoryFootprint is enabled - ASF JIRA
[AMQ-6221] ActiveMQTextMessage should synchronize on state changes - ASF JIRA
[AMQ-6218] Message content returns null occasionally from Virtual Topic to the consumer - ASF JIRA
[AMQ-3369] occasionally NPE in ActiveMQTextMessage.getSize() - ASF JIRA
[AMQ-2480] Stomp Transport Dispatcher Fails on NPE - ASF JIRA
[AMQ-3605] NullPointerException in TransportConnection - ASF JIRA
Log in - ASF JIRA
31610 – [RFE][Patch] errorproperty attribute to <subant> task
Missing Bug ID
