<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body>
<div>
<div>
<div dir="ltr" style="">
<div dir="ltr" style="color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
That policy to not comment on security issues is really frustrating. Or even worse are there other reasons I get ignored?</div>
<div dir="ltr" style="color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<br>
</div>
<div dir="ltr" style="color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
Anyway, i got a note on Twitter that 17 and 8(April) backport has a specific system property already:</div>
<div dir="ltr" style="color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<br>
</div>
<div dir="ltr" style="color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<b style="box-sizing: border-box; margin: 0px; list-style: none; caret-color: rgb(0, 0, 0); font-family: OracleSansVF, OracleSansVFCyGr, -apple-system, BlinkMacSystemFont, "Segoe UI", "Helvetica Neue", sans-serif; font-size: 13.324711799621582px; color: rgb(0, 0, 0); background-repeat: no-repeat no-repeat;"><a href="https://www.oracle.com/java/technologies/javase/8u291-relnotes.html#JDK-8244473" style="box-sizing: border-box; margin: 0px; color: rgb(0, 107, 143); background-repeat: no-repeat no-repeat;"><span style="box-sizing:border-box;margin:0px;background-repeat:no-repeat no-repeat">➜</span></a> New
System and Security Properties to Control Reconstruction of Remote Objects by JDK's Built-in JNDI RMI and LDAP Implementations</b>
<p style="box-sizing: border-box; margin: 0px 0px 1.1em; list-style: none; line-height: 1.55; caret-color: rgb(0, 0, 0); font-family: OracleSansVF, OracleSansVFCyGr, -apple-system, BlinkMacSystemFont, "Segoe UI", "Helvetica Neue", sans-serif; font-size: 13.324711799621582px; color: rgb(0, 0, 0); background-repeat: no-repeat no-repeat;">
<code style="box-sizing:border-box;margin:0px;background-repeat:no-repeat no-repeat">jdk.jndi.object.factoriesFilter</code></p>
<p style="box-sizing: border-box; margin: 0px 0px 1.1em; list-style: none; line-height: 1.55; caret-color: rgb(0, 0, 0); font-family: OracleSansVF, OracleSansVFCyGr, -apple-system, BlinkMacSystemFont, "Segoe UI", "Helvetica Neue", sans-serif; font-size: 13.324711799621582px; color: rgb(0, 0, 0); background-repeat: no-repeat no-repeat;">
com.sun.jndi.ldap.object.trustSerialData</p>
Those seem to be an important fix, not sure how I could miss them and why nobody mentioned them in the log4shell discussions yet.</div>
<div dir="ltr" style="color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<br>
</div>
<div dir="ltr" style="color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
Gruss</div>
<div dir="ltr" style="color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
Bernd</div>
</div>
</div>
<div id="ms-outlook-mobile-signature">
<div><br>
</div>
<div><br>
</div>
<div style="direction: ltr;">-- </div>
<div style="direction: ltr;">http://bernd.eckenfels.net</div>
</div>
</div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>Von:</b> security-dev <security-dev-retn@openjdk.java.net> im Auftrag von Bernd Eckenfels <ecki@zusammenkunft.net><br>
<b>Gesendet:</b> Monday, December 13, 2021 7:28:53 AM<br>
<b>An:</b> security-dev@openjdk.java.net <security-dev@openjdk.java.net><br>
<b>Betreff:</b> Why no JNDI de-ser killswitch</font>
<div> </div>
</div>
<div>
<div dir="ltr">
<div></div>
<div style="">
<div dir="ltr">Hello,</div>
<div dir="ltr"><br>
</div>
<div dir="ltr">I can understand that ldapcontext.lookup() still has to use unsafe deserialisation for legacy reasons (JMS factories etc). But it would be really good if there would be a bit more infra like a killswitch or url-prefix filter JNDI for those who
don’t need that.</div>
<div dir="ltr"><br>
</div>
<div dir="ltr">It was a rather damaging move to claim that there is a fix when the actual rce with JNDI is still present.</div>
<div dir="ltr"><br>
</div>
<div dir="ltr">I tink the new ObjectInputStream filters (jep290) are a good thing, but they are not easy to set globally on a bigger app server,especially not with 8 and 11 without jep415. So I think that’s not sufficient</div>
<div dir="ltr"><br>
</div>
<div dir="ltr">Gruss</div>
<div dir="ltr">Bernd</div>
<div id="x_ms-outlook-mobile-signature">
<div><br>
</div>
<div><br>
</div>
<div style="direction:ltr">-- </div>
<div style="direction:ltr">http://bernd.eckenfels.net</div>
</div>
</div>
</div>
</div>
</body>
</html>