21–27 of 27 posts
I'm from the Jenkins project. I wish the authors of this post gave us a heads up beforehand. It put our users at unnecessary risk. At Jenkins project, We've published a mitigation script ( https://jenkins-ci.org/content/mitigating-unauthenticated-re... ) while we work out a better fix for users.
I guess they really wanted those minutes of fame.
I'm from the Jenkins project. I wish the authors of this post gave us a heads up beforehand. It put our users at unnecessary risk. At Jenkins project, We've published a mitigation script ( https://jenkins-ci.org/content/mitigating-unauthenticated-re... ) while we work out a better fix for users.
Anyone actually have a CVE I can reference in talks to leadership so I can not look like a neckbeard security geek that's acting self-important?
I'm from the Jenkins project. I wish the authors of this post gave us a heads up beforehand. It put our users at unnecessary risk. At Jenkins project, We've published a mitigation script ( https://jenkins-ci.org/content/mitigating-unauthenticated-re... ) while we work out a better fix for users.
It seems that users have already been at unnecessary risk, given In fact, even though proof of concept code was released OVER 9 MONTHS AGO, none of the products mentioned in the title of this post have been patched, along with many more.
Earlier quoted context omitted.
The straightforward headline would be "Security flaw in commons-collection deserialization". The anti-java snark really isn't welcome.
Its not really a problem with commons-collections and unfair to color it as their issue. Its like blaming the library that is part of a ROP chain for the exploit. The issue is what gets you in first, which is instantiating objects without any thought as to what they are from un-trusted sources. Something that is called out in the Java secure coding guidelines: http://www.oracle.com/technetwork/java/seccodeguide-13906…
Earlier quoted context omitted.
It seems that users have already been at unnecessary risk, given In fact, even though proof of concept code was released OVER 9 MONTHS AGO, none of the products mentioned in the title of this post have been patched, along with many more.
Has anybody reported anything? The commons project seems to have been made aware of this just this weekend through third parties. If nobody reported anything no wonder it didn't get fixed.
Anyone actually have a CVE I can reference in talks to leadership so I can not look like a neckbeard security geek that's acting self-important?