Uploaded image for project: 'JBoss VFS'
  1. JBoss VFS
  2. JBVFS-176

CertificateReaderInputStream can eagerly load certificate information, causing SecurityException

This issue belongs to an archived project. You can view it, but you can't modify it. Learn more

    XMLWordPrintable

Details

    • Bug
    • Status: Resolved
    • Critical
    • Resolution: Done
    • 2.2.0.GA
    • 2.2.1.GA
    • Release
    • None

    Description

      The version in question is 2.2.0.SP1

      CertificateReaderInputStream can cause the certificate information within EntryInfo to be initialised before the JarVerifier has had the opportunity to initialise the certificates associated with its JarEntry, resulting in this information being ignored. This is a particular problem if the entry represents a class file as any subsequent attempt to define the class will not be associated with the correct certificate/signers, causing a SecurityException to be raised if classes from the same package have already been loaded.

      The SecurityException will be similar to the following

      java.lang.SecurityException: class "org.drools.spi.CompiledInvoker"'s signer information does not match signer information of other classes in the same package

      Attachments

        Issue Links

          Activity

            People

              ajustin@redhat.com Ales Justin
              kconner@redhat.com Kevin Conner
              Archiver:
              samahaja@redhat.com Sagar Mahajan

              Dates

                Created:
                Updated:
                Resolved:
                Archived: