Jackson Databind deserialization in EAP 6.4
Issue
- How to protect EAP 6.4 from jackson databind deserialization vulnerabilities?
-
Getting error with custom JSON Jackson mappings:
org.codehaus.jackson.map.JsonMappingException: Illegal type (<fully qualified class name>) to deserialize: prevented for security reasons
Environment
- Red Hat JBoss Enterprise Application Platform (EAP)
- 6.4 CP20
Subscriber exclusive content
A Red Hat subscription provides unlimited access to our knowledgebase of over 48,000 articles and solutions.
Close
Welcome! Check out the Getting Started with Red Hat page for quick tours and guides for common tasks.