4 ms·

I don’t see how the linked code is an RCE. The deserialization function is used on trusted input from an object that is already in memory. How is this being up

by vips7L 5y ago

I don’t see how the linked code is an RCE. The deserialization function is used on trusted input from an object that is already in memory. How is this being upvoted without an actual POC and using language like “possible” and “may”?

topspin 5y ago
"How is this being upvoted without an actual POC and using language like “possible” and “may”?" I appreciate being made aware of the speculation given the ubiquity of Spring. Those that claim an RCE in core Spring would be an order of magnitude worse than Log4Shell aren't wrong.