search

vdenotaris / spring-boot-security-saml-sample

SBS3 — A sample SAML 2.0 Service Provider built on Spring Boot.
https://sbs3.vdenotaris.com
Apache License 2.0
564 stars 351 forks source link

Deserialization of Untrusted Data (CVE-2019-16335) #74

Closed vdenotaris closed 5 years ago

vdenotaris commented 5 years ago

Deserialization of Untrusted Data com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data. A Polymorphic Typing issue was discovered as com.zaxxer.hikari.HikariDataSource was not blocked. Note: This is a different vulnerability than CVE-2019-14540.

vdenotaris commented 5 years ago

Fixed in https://github.com/vdenotaris/spring-boot-security-saml-sample/releases/tag/2.2.1.RELEASE