From a65481d24ba0251de3cabfce2d2e97e48ff37516 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Timo=20M=C3=BCller?= Date: Tue, 4 May 2021 17:30:49 +0200 Subject: [PATCH] Apply suggestions from code review more precise help text --- .../CWE/CWE-665/InsecureRmiJmxEnvironmentConfiguration.qhelp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/java/ql/src/experimental/Security/CWE/CWE-665/InsecureRmiJmxEnvironmentConfiguration.qhelp b/java/ql/src/experimental/Security/CWE/CWE-665/InsecureRmiJmxEnvironmentConfiguration.qhelp index 58391d7dc46..4bd71587177 100644 --- a/java/ql/src/experimental/Security/CWE/CWE-665/InsecureRmiJmxEnvironmentConfiguration.qhelp +++ b/java/ql/src/experimental/Security/CWE/CWE-665/InsecureRmiJmxEnvironmentConfiguration.qhelp @@ -61,7 +61,7 @@ For this reason an initialization with a null environment is also v
  • Deserialization of arbitrary objects could lead to remote code execution as described following: OWASP Deserialization of untrusted data.
  • Issue discovered in Tomcat (CVE-2016-8735): OWASP ESAPI.
    • -
  • Oracle release notes fixing the issue: Rlease Notes.
    • +
  • Oracle release notes: New attribute for JMX RMI JRMP servers.
  • Java 10 API specification for RMIConnectorServer.CREDENTIALS_FILTER_PATTERN
  • The Java API specification for RMIConnectorServer.CREDENTIAL_TYPES. Please note that this field is deprecated since Java 10.
    •