Skip to content

Commit

Permalink
Fixed #2826, #2827
Browse files Browse the repository at this point in the history
  • Loading branch information
cowtowncoder committed Aug 22, 2020
1 parent 3d97153 commit e701bd8
Show file tree
Hide file tree
Showing 2 changed files with 10 additions and 2 deletions.
4 changes: 4 additions & 0 deletions release-notes/VERSION-2.x
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,10 @@ Project: jackson-databind
(reported by Al1ex@knownsec)
#2814: Block one more gadget type (xxx, CVE-xxxx-xxx)
(reported by ChenZhaojun)
#2826: Block one more gadget type (xxx, CVE-xxxx-xxx)
(reported by ChenZhaojun)
#2827: Block one more gadget type (xxx, CVE-xxxx-xxx)
(reported by ChenZhaojun)

2.9.10.5 (21-Jun-2020)

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@
* Helper class used to encapsulate rules that determine subtypes that
* are invalid to use, even with default typing, mostly due to security
* concerns.
* Used by <code>BeanDeserializerFacotry</code>
* Used by <code>BeanDeserializerFactory</code>
*
* @since 2.8.11
*/
Expand Down Expand Up @@ -201,7 +201,11 @@ public class SubTypeValidator

// [databind#2798]: com.pastdev.httpcomponents:
s.add("com.pastdev.httpcomponents.configuration.JndiConfiguration");


// [databind#2826], [databind#2827]
s.add("com.nqadmin.rowset.JdbcRowSetImpl");
s.add("org.arrah.framework.rdbms.UpdatableJdbcRowsetImpl");

DEFAULT_NO_DESER_CLASS_NAMES = Collections.unmodifiableSet(s);
}

Expand Down

0 comments on commit e701bd8

Please sign in to comment.