[CXF-4172] Default JAX-RS XML, JSON and Form providers are open to the hash collision attacks

• Type: Bug
• Status: Closed
• Priority: Critical
• Resolution: Fixed
• Fix Version/s: 2.3.10, 2.4.7, 2.5.3, 2.6
• Component/s: JAX-RS, JAX-RS Security
• Estimated Complexity: Unknown
• Assignee: Sergey Beryozkin
• Reporter: Sergey Beryozkin
• Created: 09/Mar/12 13:55
• Updated: 23/Apr/12 16:45
• Resolved: 14/Mar/12 17:11

Description

Default XML, JSON and Form providers using the Maps internally are open to the hash collision attacks.

This includes JAXBElementProvider and JSONProvider (JAXB-driven), SourceProvider, FormEncodingProvider.