DocumentationOverview
About vulnerability
Objenesis before 3.6 contains a type confusion vulnerability that allows code in one class loader to substitute objects into another by exploiting instantiator caching keyed on class name. When a shared ObjenesisStd instance caches instantiators by clazz.getName() in ObjenesisBase.getInstantiatorOf(), same-named classes collide, causing newInstance() to return wrong-class objects and ClassCastException failures.Details
- Affected product:
- Apache CXF , Apache Commons , Apache Hadoop , Apache Hive , Apache Kafka , Apache Log4j , Apache Maven , Apache Spark , Apache Tapestry , Elasticsearch , Hibernate , Netty , Plexus , Spring , Thymeleaf , activemq , agepredictor , alluxio , arrow , awaitility , aws-sdk-java-v2 , camel , chill , corda , dozer , easymock , eureka , fast-serialization , felix-dev , flink , geode , glassfish-hk2 , grails-core , grpc-java , hbase , ignite , infinispan , jersey , karaf , kite , kryo , kryo-serializers , kryo-shaded , micrometer , micrometer-tracing , mina , mockito , objenesis , orc , parquet-java , powermock , pravega , pulsar , redisson , ribbon , rsocket-java , storm , tika , tinkerpop
- Affected packages:
- objenesis @ 3.2 (+18961 more)