We read every piece of feedback, and take your input very seriously.
To see all available qualifiers, see our documentation.
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
大佬,你好,我是@abbykimi,我IDE运行您这个项目的时候,提示有几个漏洞,项目调用了com.alipay.sofa:hessian等53个开源组件,存在44个安全漏洞,建议你升级下。
漏洞标题:SOFA-Hessian 代码问题漏洞 漏洞编号:CVE-2019-9212 漏洞描述: SOFA-Hessian是一款开源的二进制序列化协议。 SOFA-Hessian 4.0.2及之前版本中存在代码问题漏洞,该漏洞源于程序没有将com.caucho.naming.Qname和com.sun.org.apache.xpath.internal.objects.Xstring加入黑名单。远程攻击者可借助特制的序列化对象利用该漏洞执行任意命令。 国家漏洞库信息:https://www.cnvd.org.cn/flaw/show/CNVD-2019-12889 影响范围:[0, 4.0.3) 最小修复版本:4.0.3 引入路径: com.roydb:roykv@1.0-SNAPSHOT->com.alipay.sofa:hessian@3.3.6
另外43个漏洞 ,信息有点多我就不贴了,你自己看下完整报告:https://www.mfsec.cn/jr?p=i9d92f
如果你对这个issues有任何疑问可以回复我哈( @abbykimi ),我会及时回复你的。
The text was updated successfully, but these errors were encountered:
No branches or pull requests
大佬,你好,我是@abbykimi,我IDE运行您这个项目的时候,提示有几个漏洞,项目调用了com.alipay.sofa:hessian等53个开源组件,存在44个安全漏洞,建议你升级下。
另外43个漏洞 ,信息有点多我就不贴了,你自己看下完整报告:https://www.mfsec.cn/jr?p=i9d92f
如果你对这个issues有任何疑问可以回复我哈( @abbykimi ),我会及时回复你的。
The text was updated successfully, but these errors were encountered: