[
https://issues.apache.org/jira/browse/TINKERPOP-3278?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18100194#comment-18100194
]
ASF GitHub Bot commented on TINKERPOP-3278:
-------------------------------------------
Cole-Greer commented on PR #3578:
URL: https://github.com/apache/tinkerpop/pull/3578#issuecomment-5122440116
VOTE +1
> Gryo IO unsafe Java deserialization
> -----------------------------------
>
> Key: TINKERPOP-3278
> URL: https://issues.apache.org/jira/browse/TINKERPOP-3278
> Project: TinkerPop
> Issue Type: Bug
> Components: io
> Affects Versions: 4.0.0, 3.7.7, 3.8.2
> Reporter: Guian Gumpac
> Priority: Major
>
> Gryo registers several {{TraversalStrategy}} types (and
> {{{}TraversalExplanation{}}}) with Kryo's {{{}JavaSerializer{}}}, so reading
> a Gryo document deserializes attacker-controlled bytes via
> {{{}ObjectInputStream.readObject(){}}}.
> Affected: {{gremlin-core}} Gryo IO ({{{}GryoVersion{}}}/{{{}GryoMapper{}}}),
> consumed by {{{}io(){}}}, {{{}GryoReader{}}}, {{{}GryoWriter{}}},
> {{{}GryoIo{}}}, and the Hadoop Gryo IO formats. Gryo 1.0 and 3.0.
> {{JavaSerializer.read()}} wraps the Kryo input in a
> {{java.io.ObjectInputStream}} and calls {{{}readObject(){}}}, which
> reconstructs and runs an arbitrary {{Serializable}} object graph during
> decoding, before any graph-level validation. Reading a Gryo file from an
> untrusted source is therefore an unsafe-deserialization sink: it can cause
> denial of service and, on a classpath with a usable gadget chain, arbitrary
> code execution. Gryo is not on the wire, so the surface is untrusted files
> and OLAP inputs ({{{}io().read(){}}}, {{gryo}} graph persistence,
> Hadoop/Spark).
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
