Page History

...

If sensitive data can be serialized, it may be transmitted over an insecure connection, stored in an insecure location, or disclosed inappropriately.

Rule	Severity	Likelihood	Remediation Cost	Priority	Level
SER03-J	Medium	Likely	High	P6	L2

Automated Detection

Tool

Version

Checker

Description

7.5

UNSAFE_DESERIALIZATION

Implemented

Include Page

java:

	Parasoft_V

java:

	Parasoft_V

SECURITY.ESD.SIF

Implemented

Inspect instance fields of serializable objects to make sure they will not expose sensitive information

MITRE CWE	CWE-499, Serializable Class Containing Sensitive Data CWE-502, Deserialization of Untrusted Data
Secure Coding Guidelines for Java SE, Version 5.0	Guideline 8-2 / SERIAL-2: Guard sensitive data during serialization

[Bloch 2005]	Puzzle 83, "Dyslexic monotheism"
[Bloch 2001]	Item 1, "Enforce the Singleton Property with a Private Constructor"
[Greanier 2000]	Discover the Secrets of the Java Serialization API
[Harold 1999]


[Long 2005]	Section 2.4, "Serialization"
[Sun 2006]	Serialization Specification, A.4, Preventing Serialization of Sensitive Data

...