Description
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Johnzon.
ClassConverter loads & static-initializes an attacker-named class from untrusted JSON.
This issue affects Apache Johnzon: from 1.0.0 before 2.2.0.
Users are recommended to upgrade to version 1.3.1 (javax namespace) or 2.2.0 (jakarta specification namespace), which fixes the issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache Johnzon | 2.0.0 – < 2.2.0, 1.0.0 – < 1.3.1 | 2.2.0 |