Mailing-List: contact users-help@tomcat.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Tomcat Users List" <users@tomcat.apache.org>
MIME-Version: 1.0
In-Reply-To: 
 <CAMCpviWJaB7SSMPaiOq+_bvbKdSpjVK79dHoEAtFo_NNyt_QMg@mail.gmail.com>
References: 
 <CAMCpviWJaB7SSMPaiOq+_bvbKdSpjVK79dHoEAtFo_NNyt_QMg@mail.gmail.com>
From: Johan Compagner <jcompagner@servoy.com>
Date: Wed, 11 Nov 2015 14:07:05 +0100
Message-ID: 
 <CADcYmTK14bjie6Ak8hq-i6v_O9xiLuUNDZOGpv1uv5nzCSZEzg@mail.gmail.com>
Subject: Re: java deserialization vulnerability for Tomcat 7/8
To: Tomcat Users List <users@tomcat.apache.org>
Content-Type: multipart/alternative; boundary=001a114194e4a4447105244381ce

--001a114194e4a4447105244381ce
Content-Type: text/plain; charset=UTF-8

don't think tomcat by default ships with commons collections

But of course its not just commons collections its a more generic problem
that could be hit if there are more special classes that do special things
in deserialization.

i do think that tomcat by default (even the manager app or there jmx proxy
servlet) doesn't use java serialization to the outside world
And the jmx port should be default only accessible from localhost


On 11 November 2015 at 13:58, satish jupalli <jupallis@gmail.com> wrote:

> Hi,
>
> Would like to get your opinion on the java deserialization vulnerability
> issue for Tomcat. As Jboss seems to have been impacted with, is there a way
> to verify wether this vulnerability affects Tomcat as well?
>
> Regards
> SJ
>


-- 
Johan Compagner
Servoy

--001a114194e4a4447105244381ce--