Block one more gadget type (weblogic/oracle-aqjms, CVE-2020-14061) #2698
Comments
martokarski
pushed a commit
to atlassian/jackson-1
that referenced
this issue
May 8, 2020
cowtowncoder
changed the title
cowtowncoder
changed the title
cowtowncoder
changed the title
cowtowncoder
changed the title
cowtowncoder
changed the title
qxo
added a commit
to qxo/jackson-databind
that referenced
this issue
Sep 21, 2020
…L#2659 FasterXML#2660 FasterXML#2662 FasterXML#2664 FasterXML#2666 FasterXML#2670 FasterXML#2680 FasterXML#2682 FasterXML#2688 FasterXML#2698 FasterXML#2704 FasterXML#2765 FasterXML#2798 FasterXML#2814 FasterXML#2826 FasterXML#2827 FasterXML#2854 1. generated diff CVE diff git diff ad5a630 -- src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java 2. cleanup the diff ,just remain the CVE change 3. apply the diff 4. check and make sure only commit the AutoType CVE change. ``` PR_LIST=$(git log1 -n 17 ad5a630 -- src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java | awk -F'[ ,]+' '{for(i=1;i<=NF;i++){a=$(i);if(match(a,/#[0-9]+/)){print a;}}}' | sort | uniq);echo "$PR_LIST" | wc -l echo $PR_LIST ```
cowtowncoder
pushed a commit
that referenced
this issue
Sep 22, 2020
#2670 #2680 #2682 #2688 #2698 #2704 #2765 #2798 #2814 #2826 #2827 #2854 (#2858) 1. generated diff CVE diff git diff ad5a630 -- src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java 2. cleanup the diff ,just remain the CVE change 3. apply the diff 4. check and make sure only commit the AutoType CVE change. ``` PR_LIST=$(git log1 -n 17 ad5a630 -- src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java | awk -F'[ ,]+' '{for(i=1;i<=NF;i++){a=$(i);if(match(a,/#[0-9]+/)){print a;}}}' | sort | uniq);echo "$PR_LIST" | wc -l echo $PR_LIST ```
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Another gadget type(s) reported regarding class(es) of
aqapi.jarlibrary, included in Weblogic (for Oracle AQ/JMS support).See https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 for description of the general problem.
Mitre id: CVE-2020-14061
Reporter(s): Fangrun Li (Cloud Security Team at Qihoo 360)
Fix will be included in:
The text was updated successfully, but these errors were encountered: