Threats tagged 'ghsa-pp89-732f-3g8q'

OpenAM Community Edition through version 16.0.6 contains an unsafe Java deserialization vulnerability in its Push Notification SNS callback resource. The REST endpoint handling SNS push messages allows anonymous access and can deserialize attacker-controlled JSON after fallback to a persistent CTS-stored blob. This flaw enables class-loading and Jackson-based object construction with attacker-controlled data, potentially leading to process execution, file writes, or denial of service depending on the environment. The issue is patched in version 16.1.1.