You are viewing a plain text version of this content. The canonical link for it is here.

Posted to issues@ignite.apache.org by "Roman Puchkovskiy (Jira)" <ji...@apache.org> on 2022/02/03 13:08:00 UTC

[jira] [Created] (IGNITE-16466) User Object Serialization Security

Roman Puchkovskiy created IGNITE-16466:
------------------------------------------

             Summary: User Object Serialization Security
                 Key: IGNITE-16466
                 URL: https://issues.apache.org/jira/browse/IGNITE-16466
             Project: Ignite
          Issue Type: Improvement
          Components: networking
            Reporter: Roman Puchkovskiy
             Fix For: 3.0.0-alpha5


Recently, there were a lot of vulnerabilities related to the JDK Serialization. User Object Seriailzation supports Serializable and its callbacks, so it is probably also susceptible to the same attacks.

We could, for example, implement white-lists of the classes we are allowed to deserialize.

Also, we could restrict ourselves to only allowing classes from known classloaders.



--
This message was sent by Atlassian Jira
(v8.20.1#820001)