Dropwizard-Validation 注入漏洞

漏洞信息详情

Dropwizard-Validation 1.3.19之前版本和2.0.2之前版本中的自我验证功能存在注入漏洞。远程攻击者可借助任意Java表达式利用该漏洞在系统上执行任意代码。

目前厂商已发布升级补丁以修复漏洞，补丁获取链接：

https://github.com/dropwizard/dropwizard/security/advisories/GHSA-3mcp-9wr4-cjqf

来源:CONFIRM

链接:https://github.com/dropwizard/dropwizard/security/advisories/GHSA-3mcp-9wr4-cjqf

来源:MISC

链接:https://github.com/dropwizard/dropwizard/pull/3157

来源:MISC

链接:https://docs.jboss.org/hibernate/validator/6.1/reference/en-US/html_single/#section-interpolation-with-message-expressions

来源:MISC

链接:https://docs.oracle.com/javaee/7/tutorial/jsf-el.htm

来源:MISC

链接:https://beanvalidation.org/2.0/spec/#validationapi-message-defaultmessageinterpolation

来源:MISC

链接:https://github.com/dropwizard/dropwizard/pull/3160

来源:MISC

链接:https://github.com/dropwizard/dropwizard/commit/d87d1e4f8e20f6494c0232bf8560c961b46db634

来源:nvd.nist.gov

链接:https://nvd.nist.gov/vuln/detail/CVE-2020-5245

暂无