[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-Id: <1447365167.1146869.438300073.116F736D@webmail.messagingengine.com>
Date: Thu, 12 Nov 2015 15:52:47 -0600
From: Mark Felder <feld@...d.me>
To: oss-security@...ts.openwall.com
Cc: cve-assign@...re.org
Subject: Re: CVE-Request: Assign CVE for common-collections remote
code execution on deserialisation flaw
On Thu, Nov 12, 2015, at 03:04, Gsunde Orangen wrote:
> CVE-Request:
> I appreciate this general discussion around deserialization issues and
> hope this will make a jump-start for sustainable improvements on both
> Java and application level in the long run.
> Aside of that however, I'd like to go back to Jason's original request
> to Mitre to get a CVE ID assigned to this particular issue with the
> Apache Commons Collections functors package (specifically in the
> InvokerTransformer class).
Is there any proof that Apache Commons Collections functors package
isn't doing what it's intended to be doing? Everything I'm reading
indicates that the problem is with applications believing they can
*trust* the input, not that there's a bug in the functors package, ie,
bad design.
> So people (esp. Java applications developers) have a unique reference
> when analysing and fixing this particluar one (by e.g. removing the
> class, make it non-serializable or wait for a new Commons Collections
> release that includes that fix - whatever is most appropriate to their
> application's context).
>
The currently proposed "fix"[1] is to disable functionality that is
being used. This will break applications that need them.
[1] https://issues.apache.org/jira/browse/COLLECTIONS-580
--
Mark Felder
feld@...d.me
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
