Java Deserialization Vulnerability

[thomas.bachmann]

Hi,

Did the jasper suite get tested for the Java deserialization vulnerability (http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/)? It seems to also effect groovy so may be double effected.

Thanks,

Thomas

[thomas.bachmann]

On https://blog.srcclr.com/commons-collections-deserialization-vulnerability-research-findings/ it was reported that:

• JasperReports 6.2.0
• JasperReports 6.0.2
• JasperReports 3.5.2
• JasperReports 3.5.1

amay be vulnerable to the Java deserialization vulnerability where untrusted data is deserialized. Could we please get a statement if JasperReports is vulnerable or how it can be configured to not be vulnerable?