Deserialization of Untrusted Data
FasterXML jackson-databind lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter.
Advisories for Maven/Com.fasterxml.jackson/Jackson-Base package
2020
FasterXML jackson-databind lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter.