[QPIDJMS-188] [CVE-2016-4974] allow whitelisting trusted classes/packages for deserialization from ObjectMessage

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 0.9.0
• Fix Version/s: 0.10.0
• Component/s: qpid-jms-client
• Assignee: Timothy A. Bish
• Reporter: Timothy A. Bish
• Created: 27/Jun/16 15:12
• Updated: 21/Jul/16 12:19
• Resolved: 27/Jun/16 15:33

Description

When applications call getObject() on a consumed JMS ObjectMessage they are subject to the behaviour of any object deserialization during the process of constructing the body to return.

This improvement adds the new configuration options to whitelist trusted content permitted for deserialization. When so configured, attempts to deserialize input containing other content will be prevented.