[Jackson CVEs] Update to codehaus/jackson 1.9.13.redhat-00006 and Fas…

…terXML/jackson-databind 2.6.3.redhat-4
jboss-fuse · Aug 2, 2019 · d8eff49 · d8eff49
1 parent 224f863
commit d8eff49
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 0 deletions.
diff --git a/esb/esb-assembly/jboss-fuse-karaf/src/main/filtered-resources/etc/system.properties b/esb/esb-assembly/jboss-fuse-karaf/src/main/filtered-resources/etc/system.properties
@@ -218,3 +218,6 @@ activemq.url = tcp:https://${activemq.host}:${activemq.port}
 hawtio.proxyWhitelist = localhost, 127.0.0.1
 
 profiles=jboss-fuse-full
+
+# whitelist some classes to enable polymorphic deserialization with jackson-databind
+jackson.deserialization.whitelist.packages = io.fabric8.api.commands,java.lang.String
diff --git a/mq/mq-assembly/shared/src/main/resources/snippets/system-mq.properties b/mq/mq-assembly/shared/src/main/resources/snippets/system-mq.properties
@@ -37,3 +37,6 @@ hawtio.proxyWhitelist = localhost, 127.0.0.1
 profiles=mq-amq
 karaf.local.roles = admin,manager,viewer,Monitor, Operator, Maintainer, Deployer, Auditor, Administrator, SuperUser
 hawtio.roles = admin,manager,viewer,Monitor, Operator, Maintainer, Deployer, Auditor, Administrator, SuperUser
+
+# whitelist some classes to enable polymorphic deserialization with jackson-databind
+jackson.deserialization.whitelist.packages = io.fabric8.api.commands,java.lang.String