[
https://issues.apache.org/jira/browse/TINKERPOP-3278?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Cole Greer closed TINKERPOP-3278.
---------------------------------
Fix Version/s: 3.7.7
3.8.2
Assignee: Cole Greer
Resolution: Fixed
> Gryo IO unsafe Java deserialization
> -----------------------------------
>
> Key: TINKERPOP-3278
> URL: https://issues.apache.org/jira/browse/TINKERPOP-3278
> Project: TinkerPop
> Issue Type: Bug
> Components: io
> Affects Versions: 4.0.0, 3.7.7, 3.8.2
> Reporter: Guian Gumpac
> Assignee: Cole Greer
> Priority: Major
> Fix For: 3.7.7, 3.8.2
>
>
> Gryo registers several {{TraversalStrategy}} types (and
> {{{}TraversalExplanation{}}}) with Kryo's {{{}JavaSerializer{}}}, so reading
> a Gryo document deserializes attacker-controlled bytes via
> {{{}ObjectInputStream.readObject(){}}}.
> Affected: {{gremlin-core}} Gryo IO ({{{}GryoVersion{}}}/{{{}GryoMapper{}}}),
> consumed by {{{}io(){}}}, {{{}GryoReader{}}}, {{{}GryoWriter{}}},
> {{{}GryoIo{}}}, and the Hadoop Gryo IO formats. Gryo 1.0 and 3.0.
> {{JavaSerializer.read()}} wraps the Kryo input in a
> {{java.io.ObjectInputStream}} and calls {{{}readObject(){}}}, which
> reconstructs and runs an arbitrary {{Serializable}} object graph during
> decoding, before any graph-level validation. Reading a Gryo file from an
> untrusted source is therefore an unsafe-deserialization sink: it can cause
> denial of service and, on a classpath with a usable gadget chain, arbitrary
> code execution. Gryo is not on the wire, so the surface is untrusted files
> and OLAP inputs ({{{}io().read(){}}}, {{gryo}} graph persistence,
> Hadoop/Spark).
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
