You are viewing a plain text version of this content. The canonical link for it is here.

Posted to dev@river.apache.org by Peter Firmstone <pe...@zeus.net.au> on 2020/10/13 04:59:27 UTC

Serialization and serial form

The following is an interesting slide:

https://speakerdeck.com/pwntester/surviving-the-java-deserialization-apocalypse?slide=31

Oracle has stated they will not fix these security issues with 
Collection classes for de-serialization.

River-49 also identifies serial form issues with Collections.

https://issues.apache.org/jira/projects/RIVER/issues/RIVER-49?filter=allopenissues

Cheers,

Peter.