Remote Code Execution

spring-batch-core is vulnerable to remote code execution. The upgrade of Jackson in 4.2.3.RELEASE enabled default typing by default and resulted in Spring Batch to be vulnerable to untrusted deserialization. An attacker will be able to execute arbitrary code if ExecutionContext is serialized and...

CVE-2020-5411

When configured to enable default typing, Jackson contained a deserialization vulnerability that could lead to arbitrary code execution. Jackson fixed this vulnerability by blacklisting known "deserialization gadgets". Spring Batch configures Jackson with global default typing enabled which means...