Block two more gadget types (ehcache/JNDI - CVE-2019-20330)

Merged from FasterXML/jackson-databind#2526
atlassian · May 8, 2020 · 35211ad · 35211ad
1 parent 6c4280f
commit 35211ad
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 0 deletions.
diff --git a/release-notes/VERSION b/release-notes/VERSION
@@ -46,6 +46,7 @@ One more patch release for 1.9.
 * [databind#2460]: Block one mode gadget type (ehcache, CVE-2019-17267)
 * [databind#2478]: Block two more gadget types (commons-dbcp, p6spy)
 * [databind#2498]: Block one more gadget type (log4j-extras/1.2)
+* [databind#2526]: Block two more gadget types (ehcache/JNDI - CVE-2019-20330)
 
 1.9.13 (14-Jul-2013)
 

diff --git a/src/mapper/java/org/codehaus/jackson/map/jsontype/impl/SubTypeValidator.java b/src/mapper/java/org/codehaus/jackson/map/jsontype/impl/SubTypeValidator.java
@@ -101,6 +101,10 @@ public class SubTypeValidator
         s.add("org.apache.log4j.receivers.db.DriverManagerConnectionSource");
         s.add("org.apache.log4j.receivers.db.JNDIConnectionSource");
 
+        // [databind#2526]: some more ehcachex
+        s.add("net.sf.ehcache.transaction.manager.selector.GenericJndiSelector");
+        s.add("net.sf.ehcache.transaction.manager.selector.GlassfishSelector");
+
         DEFAULT_NO_DESER_CLASS_NAMES = Collections.unmodifiableSet(s);
     }