Critical remote code execution flaw patched in Veeam backup servers

Why black lists are unhealthy

Utility builders have gotten within the behavior of mitigating deserialization dangers by creating blacklists of courses that might be harmful when deserialized, and as watchTowr explains, this was additionally Veeam’s method when addressing CVE-2024-40711. Nonetheless, historical past has proven that blacklists are not often full.

“Blacklists (also referred to as block-lists or deny-lists) are primarily based on a really optimistic (and provably flawed) concept that we will simply make a listing of all of the unhealthy courses, and we simply preserve a file of every part unhealthy that may be carried out and replace our record as and when new unhealthy is launched,” the researchers wrote.

“Fortunately, as an business, we truly have already got a listing of all of the unhealthy courses on the planet, and so that is flawless logic. There are a few bitter truths although: It is a lie. Whereas we will agree that these days it’s extraordinarily laborious to search out new deserialization devices in programming languages and frameworks (though nonetheless doable), merchandise have their very own codebase and may comprise abusable courses that may be misused throughout deserialization,” the researchers added. “That is earlier than we even get on to third social gathering libraries.”