am.ik.home:uaa-client (>=1.3.0, <=1.9.0), am.ik.home:uaa-integration-test (>=1.3.0, <=1.9.0) +732 more potentially affected by CVE-2017-4995 via org.springframework.security:spring-security-core (>=4.2.0.release, <=4.2.2.release)

org.springframework.security:spring-security-core MAVEN version =4.2.0.release, =1.3.0, =1.3.0, =1.3.0, =0.2.0, =1.0.3, =1.1.19-release, =1.1.23-release, =1.1.19-release, =1.1.19-release, =1.1.23-release, =1.3.2, =1.3.2, =1.3.2, =1.5.1 and more Source cves: CVE-2017-4995 Source advisory:...

am.ik.home:uaa-client (>=1.3.0, <=1.9.0), am.ik.home:uaa-integration-test (>=1.3.0, <=1.9.0) +732 more potentially affected by CVE-2017-4995 via org.springframework.security:spring-security-core (>=4.2.0.release, <=4.2.2.release)

org.springframework.security:spring-security-core MAVEN version =4.2.0.release, =1.3.0, =1.3.0, =1.3.0, =0.2.0, =1.0.3, =1.1.19-release, =1.1.23-release, =1.1.19-release, =1.1.19-release, =1.1.23-release, =1.3.2, =1.3.2, =1.3.2, =1.5.1 and more Source cves: CVE-2017-4995 Source advisory:...

CVE-2017-4995

CVE-2017-4995 describes a deserialization vulnerability in Pivotal Spring Security 4.2.0.RELEASE–4.2.2.RELEASE and Spring Security 5.0.0.M1 when Jackson default typing is enabled. If Spring Security’s Jackson support is leveraged (SecurityJackson2Modules.getModules(ClassLoader) or enableDefaultTy...

am.ik.home:uaa-client (>=1.3.0, <=1.9.0), am.ik.home:uaa-integration-test (>=1.3.0, <=1.9.0) +732 more potentially affected by CVE-2017-4995 via org.springframework.security:spring-security-core (>=4.2.0.release, <=4.2.2.release)

org.springframework.security:spring-security-core MAVEN version =4.2.0.release, =1.3.0, =1.3.0, =1.3.0, =0.2.0, =1.0.3, =1.1.19-release, =1.1.23-release, =1.1.19-release, =1.1.19-release, =1.1.23-release, =1.3.2, =1.3.2, =1.3.2, =1.5.1 and more Source cves: CVE-2017-4995 Source advisory:...

CVE-2017-4995

It was found that spring security uses Jackson's enableDefaultTyping polymorphic capability for object deserialization. Jackson has already addressed this issue by blacklisting well-known gadget classes. However, under a right circumstances e.g. an existence of an old JDK and vulnerable Jackson i...