upgrade fastjson to 1.2.70#6255
Merged
mercyblitz merged 1 commit intoJun 1, 2020
Merged
Conversation
https://help.aliyun.com/noticelist/articleid/1060343604.html?spm=a2c4g.789004748.n2.6.3f576141SGmGhG 漏洞描述 fastjson采用黑白名单的方法来防御反序列化漏洞，导致当黑客不断发掘新的反序列化Gadgets类时，在autoType关闭的情况下仍然可能可以绕过黑白名单防御机制，造成远程命令执行漏洞。经研究，该漏洞利用门槛较低，可绕过autoType限制，风险影响较大。阿里云应急响应中心提醒fastjson用户尽快采取安全措施阻止漏洞攻击。 影响版本 fastjson <=1.2.68 fastjson sec版本 <= sec9 安全版本 fastjson >=1.2.69 fastjson sec版本 >= sec10
Codecov Report
@@ Coverage Diff @@
## 2.6.x #6255 +/- ##
============================================
- Coverage 47.51% 47.46% -0.06%
+ Complexity 4615 4435 -180
============================================
Files 577 566 -11
Lines 26522 25227 -1295
Branches 4695 4467 -228
============================================
- Hits 12602 11974 -628
+ Misses 12002 11414 -588
+ Partials 1918 1839 -79
Continue to review full report at Codecov.
|
Kvicii
pushed a commit
to Kvicii/dubbo
that referenced
this pull request
Jun 6, 2020
* '2.6.x' of github.com:apache/dubbo: upgrade fastjson to 1.2.70 (apache#6255)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
https://help.aliyun.com/noticelist/articleid/1060343604.html?spm=a2c4g.789004748.n2.6.3f576141SGmGhG
漏洞描述
fastjson采用黑白名单的方法来防御反序列化漏洞，导致当黑客不断发掘新的反序列化Gadgets类时，在autoType关闭的情况下仍然可能可以绕过黑白名单防御机制，造成远程命令执行漏洞。经研究，该漏洞利用门槛较低，可绕过autoType限制，风险影响较大。阿里云应急响应中心提醒fastjson用户尽快采取安全措施阻止漏洞攻击。
影响版本
fastjson <=1.2.68
fastjson sec版本 <= sec9
安全版本
fastjson >=1.2.69
fastjson sec版本 >= sec10