jackson-databind/CVE-2020-14061.patch
2020-09-20 00:02:00 +08:00

33 lines
1.4 KiB
Diff

From 5c8642aeae9c756b438ab7637c90ef3c77966e6e Mon Sep 17 00:00:00 2001
From: Tatu Saloranta <tatu.saloranta@iki.fi>
Date: Fri, 24 Apr 2020 20:39:14 -0700
Subject: [PATCH] Fix #2698
---
.../jackson/databind/jsontype/impl/SubTypeValidator.java | 9 +++++++++
1 files changed, 9 insertions(+)
diff --git a/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java b/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java
index a7853c026..20bbf2059 100644
--- a/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java
+++ b/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java
@@ -183,6 +183,15 @@ public class SubTypeValidator
// [databind#2688]: apache/drill
s.add("oadd.org.apache.xalan.lib.sql.JNDIConnectionPool");
+ // [databind#2698]: weblogic w/ oracle/aq-jms
+ // (note: dependency not available via Maven Central, but as part of
+ // weblogic installation, possibly fairly old version(s))
+ s.add("oracle.jms.AQjmsQueueConnectionFactory");
+ s.add("oracle.jms.AQjmsXATopicConnectionFactory");
+ s.add("oracle.jms.AQjmsTopicConnectionFactory");
+ s.add("oracle.jms.AQjmsXAQueueConnectionFactory");
+ s.add("oracle.jms.AQjmsXAConnectionFactory");
+
DEFAULT_NO_DESER_CLASS_NAMES = Collections.unmodifiableSet(s);
}
--
2.23.0