3 ms·
CVE-2017-9805 is yet another deserialization vulnerability from a language and set of frameworks that seem designed to produce an endless stream of deserializat
by makomk 9y ago
CVE-2017-9805 is yet another deserialization vulnerability from a language and set of frameworks that seem designed to produce an endless stream of deserialization vulnerabilities. This should very much reflect on Java EE.
- Lightbody 9y agoNormalized by usage I would be surprised if it's actually as high as you suggest. The more popular a platform is, the more attention from bad actors there will be. Every platform has had similar vulnerabilities along the way. For example: https://www.google.com/search?q=rails+rce&ie=UTF-8&oe=UTF-8&hl=en-us&client=safari https://www.google.com/search?q=rails+rce&ie=UTF-8&oe=UTF-8&...
- peoplewindow 9y agoIs Struts Java EE? There are quite a few web frameworks in the Java space and anyone who reviews Apache CVE history will see immediately that Struts has by far the most serious problem with exploits of any product they do, let alone any Java product.