Deprecate SerializationUtils#deserialize#28075
Conversation
As based on Java's serialization mechanism, it can be the source of Remote Code Execution vulnerabilities.
spring-projects-issues
added
the
status: waiting-for-triage
|
I recently fixed a code using |
sbrannen
added
in: core
rstoyanchev
removed
the
status: waiting-for-triage
|
when report this cve? |
|
@Tomator01 This is not a CVE per se. Using this tool to handle user input data can lead to a CVE. |
|
This is not a CVE in the core Spring Framework. The purpose of this change is to inform anyone who had previously been using The core Spring Framework does not use If you believe you have discovered a security issue, please report it responsibly with the dedicated page: https://spring.io/security-policy And please refrain from posting any additional comments to this commit. Thank you |
6 participants
As based on Java's serialization mechanism, it can be the source of Remote Code Execution vulnerabilities.
Today this utility is part of the
publicAPI and can be naively used to convert from object to text and vice versa.However a naive use can lead to RCE vulnerability if user-input data (like files, cookies, etc.) is transfered using this utility.
I think it should be nice to at least warn the user about the use of this tool (with
@Deprecated) and later on remove it totally from the public API as this sole use in Spring code is to clone exceptions inorg.springframework.cache.jcache.interceptor.CacheResultInterceptor.I am not sure on how it can (or should) be handled.
Let me know if you need me to adapt the code of this PR.