10.0
Critique
CVE-2025-70974 Fastjson before 1.2.48 mishandles autoType because, when an @type key is in a JSON document, and the value of that key…
Description
Fastjson before 1.2.48 mishandles autoType because, when an @type key is in a JSON document, and the value of that key is the name of a Java class, there may be calls to certain public methods of that class. Depending on the behavior of those methods, there may be JNDI injection with an attacker-supplied payload located elsewhere in that JSON document. This was exploited in the wild in 2023 through 2025. NOTE: this issue exists because of an incomplete fix for CVE-2017-18349. Also, a later bypass is covered by CVE-2022-25845.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Fastjson 1.2 | premières → < 1.2.48 | 1.2.48 |
| OpenShift Service Mesh 2 | Versions non publiées | |
| Red Hat build of Apache Camel for Spring Boot 4 | Versions non publiées | |
| Red Hat build of Debezium 2 | Versions non publiées | |
| Red Hat build of Debezium 3 | Versions non publiées | |
| Red Hat Fuse 7 | Versions non publiées | |
| Red Hat JBoss Enterprise Application Platform 8 | Versions non publiées | |
| Red Hat JBoss Enterprise Application Platform Expansion Pack | Versions non publiées |
Références
- github.com github.com
- www.seebug.org www.seebug.org
- www.cnvd.org.cn www.cnvd.org.cn
- www.freebuf.com www.freebuf.com
- github.com github.com
- www.cloudsek.com www.cloudsek.com
- cert.360.cn cert.360.cn
Chronologie
- Publiée
- Dernière modification