#security

Jackson-databind and Default Typing Vulnerabilities

Today, GitHub sent out security notices to owners of projects using old jackson-databind versions (older than 2.8.11.1 and 2.9.5). These notices pertain to this issue. I have talked about its relevance before on IRC, but since it is getting more attention now, I will describe it here again. The Problem The “bug” comes from using the so-called default typing. This feature allows a user to deserialize subclasses (or...

Oct 16, 2018 — 5 minute(s) read

#jackson #json #security #serialization #xml

JavaChannel’s Interesting Links podcast, episode 14

Welcome to the fourteenth ##java podcast. Your hosts, as usual, are Joseph Ottinger, dreamreal on the IRC channel, and Andrew Lombardi from Mystic Coders (kinabalu on the channel), and it’s Wednesday, February 7, 2018. As always, this podcast is basically interesting content pulled from various sources, and funneled through the ##java IRC channel on freenode. You can find the show notes at the channel’s website, at javachannel.org; you can find all of...

Feb 7, 2018 — 3 minute(s) read

#fuzzer #github #java-10 #java-9 #kafka #license #podcast #podcast-14 #pwhash #scala #security #spark #testing

Modular password hashing with pwhash

When building web applications, we usually also have to store user authentication data. When doing so, there’s generally two choices: Either we use an external authentication provider like OAuth, or we store passwords for our users in our database. This blog post focuses on how to do the latter correctly. Password hashing basics Before we dive into the specifics of the pwhash library, we briefly discuss the basics of what we need to be...

Feb 1, 2018 — 8 minute(s) read

#password #security

Interesting links podcast, episode 4

Welcome to the fourth ##java podcast. I’m Joseph Ottinger, dreamreal on the IRC channel, and it’s Monday, 2017 October 16. This podcast covers news and interesting things from the ##java IRC channel; if you see something interesting that’s related to Java, feel free to submit it to the channel bot, with ~submit and a URL to the interesting thing, or you can also write an article for the channel blog as well...

Oct 16, 2017 — 6 minute(s) read

#android #baeldung #benchmarking #buck #cache #caffeine #ehcache #excelsior #gradle #guava #jet #jooq #kotlin #maven #openjdk #podcast #podcast-4 #security #windows #wpa2 #zulu

Interesting Links, 2017-Feb-23

Maven Polyglot: replacing pom.xml with Clojure, Scala, or Groovy Script shows how you can, well, replace the XML configuration for a Maven project with a configuration in another language. This also provides some imperative-ish features to Maven projects, plus no XML except for a short description of the scripting language. How does a relational database work provides a (very) high level description of how a relational database does its work – and if you...

Feb 23, 2017 — 2 minute(s) read

#certificate #database #garbage-collection #gc #git #graph-database #jep #maven #neo4j #security #titan