[
https://issues.apache.org/jira/browse/CXF-6711?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Daniel Kulp resolved CXF-6711.
------------------------------
Resolution: Fixed
Assignee: Daniel Kulp
Fix Version/s: 3.0.8
3.1.5
> Aegis Databinding Deserialization Vulnerability
> -----------------------------------------------
>
> Key: CXF-6711
> URL: https://issues.apache.org/jira/browse/CXF-6711
> Project: CXF
> Issue Type: Bug
> Components: Aegis Databinding
> Affects Versions: 3.1.4
> Reporter: Moritz Bechler
> Assignee: Daniel Kulp
> Fix For: 3.1.5, 3.0.8
>
>
> Just had a quick look after the topic came up on -users. Aegis Databiding
> seems to perform unsafe deserialization when serializedWhenUnknown=true. Now
> sure how common that is (and actually no experience with aegis at all), but
> if used and enabled that's pretty much direct remote code execution.
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
