Weakness (CWE)
CWE-499: Serializable Class Containing Sensitive Data
Variant Draft
The code contains a class with sensitive data, but the class does not explicitly deny serialization.
How to prevent it (2 mitigations)
-
Implementation
In Java, explicitly define final writeObject() to prevent serialization. This is the recommended solution. Define the writeObject() function to throw an exception explicitly denying serialization.
-
Implementation
Make sure to prevent serialization of your objects.
Source: MITRE CWE-499
1 result · Clear filters · Feed
-
Medium 4.9
GoCD server secret encryption/decryption key leaked to agents during material serialization
GoCD is a continuous delivery server. GoCD helps you automate and streamline the build-test-release cycle for continuous delivery of your product. GoCD versions prior to 21.1.0 leak the symmetric key used to encrypt/decrypt any secure variables/secrets in GoC…