Date: Thu, 12 Nov 2015 15:52:47 -0600 From: Mark Felder <feld@...d.me> To: oss-security@...ts.openwall.com Cc: cve-assign@...re.org Subject: Re: CVE-Request: Assign CVE for common-collections remote code execution on deserialisation flaw On Thu, Nov 12, 2015, at 03:04, Gsunde Orangen wrote: > CVE-Request: > I appreciate this general discussion around deserialization issues and > hope this will make a jump-start for sustainable improvements on both > Java and application level in the long run. > Aside of that however, I'd like to go back to Jason's original request > to Mitre to get a CVE ID assigned to this particular issue with the > Apache Commons Collections functors package (specifically in the > InvokerTransformer class). Is there any proof that Apache Commons Collections functors package isn't doing what it's intended to be doing? Everything I'm reading indicates that the problem is with applications believing they can *trust* the input, not that there's a bug in the functors package, ie, bad design. > So people (esp. Java applications developers) have a unique reference > when analysing and fixing this particluar one (by e.g. removing the > class, make it non-serializable or wait for a new Commons Collections > release that includes that fix - whatever is most appropriate to their > application's context). > The currently proposed "fix" is to disable functionality that is being used. This will break applications that need them.  https://issues.apache.org/jira/browse/COLLECTIONS-580 -- Mark Felder feld@...d.me
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.