项目引用了com.alibaba:fastjson等39个开源组件，存在36个漏洞，建议升级 #20
Comments
|
老哥，我转Golang好些年了，很少再维护Java项目，如果对Golang感兴趣可以聊聊<br/><br/>另外，如果想改Java源代码，我可以把你的账号加上权限，如有需要，请联系我<br/><br/>谢谢<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<br/><br/><br/> <a href="https://maas.mail.163.com/dashi-web-extend/html/proSignature.html?ftlId=1&name=storezhang&uid=storezhang%40gmail.com&iconUrl=https%3A%2F%2Fmail-online.nosdn.127.net%2Fwzpmmc%2Ffaab393797369670ae5ed24d4b542231.jpg&items=%5B%22%22%2C%22storezhang%40gmail.com%22%2C%22%22%2C%22%22%2C%22%22%5D" style="display:block;background:#fff; max-width: 400px; _width: 400px;padding:15px 0 10px 0;text-decoration: none; outline:none;-webkit-tap-highlight-color:transparent;-webkit-text-size-adjust:none !important;text-size-adjust:none !important;">
<table cellpadding="0" style='width: 100%; max-width: 100%; table-layout: fixed; border-collapse: collapse;color: #9b9ea1;font-size: 14px;line-height:1.3;-webkit-text-size-adjust:none !important;text-size-adjust:none !important;'>
<tbody style="font-family: 'PingFang SC', 'Hiragino Sans GB','WenQuanYi Micro Hei', 'Microsoft Yahei', '微软雅黑', verdana !important; word-wrap:break-word; word-break:break-all;-webkit-text-size-adjust:none !important;text-size-adjust:none !important;">
<tr>
<td width="38" style="padding:0; box-sizing: border-box; width: 38px;">
<img width="38" height="38" style="vertical-align:middle; width: 38px; height: 38px; border-radius:50%;" src="https://mail-online.nosdn.127.net/wzpmmc/faab393797369670ae5ed24d4b542231.jpg" />
</td>
<td style='padding: 0 0 0 10px; color: #31353b;'>
<div style="font-size: 16px;font-weight:bold; width:100%; white-space: nowrap; overflow:hidden;text-overflow: ellipsis;">storezhang</div>
</td>
</tr>
<tr width="100%" style="font-size: 14px !important; width: 100%;">
<td colspan='2' style="padding:10px 0 0 0; font-size:14px !important; width: 100%;">
<div style="width: 100%;font-size: 14px !important;word-wrap:break-word;word-break:break-all;"></div>
<div style="width: 100%;font-size: 14px ***@***.***</div>
<div style="width: 100%;font-size: 14px !important;word-wrap:break-word;word-break:break-all;"></div>
<div style="width: 100%;font-size: 14px !important;word-wrap:break-word;word-break:break-all;"></div>
<div style="width: 100%;font-size: 14px !important;word-wrap:break-word;word-break:break-all;"></div>
</td>
</tr>
</tbody>
</table>
</a><br/><br/><br/><div class="ntes-mailmaster-quote" style="padding-top: 1px; padding-bottom: 1px" >
<div style=" margin-top: 2em; margin-bottom: 1em; font-size: 14px; line-height: 1.25; color: #78787a; " >---- 回复的原邮件 ----</div>
<div style=" margin-bottom: 1em; font-size: 12px; line-height: 1.25; color: #232324; padding: 0.5em 0.25em; border-radius: 0.67em; background-color: #f0f0f0; " >
<table width="100%" cellpadding="0" cellspacing="9" border="0">
<tr>
<td valign="top" style=" width: 4.25em; font-size: 12px; line-height: 1.25; color: #78787a; " >
发件人
</td>
<td valign="top" style=" font-size: 12px; line-height: 1.25; color: #232324; word-break: break-all; " >
<a class="mail-from" style="text-decoration:none;color:#0886e8;" ***@***.******@***.***></a>
</td>
</tr>
<tr>
<td valign="top" style=" width: 4.25em; font-size: 12px; line-height: 1.25; color: #78787a; " >
日期
</td>
<td class="mail-date" valign="top" style=" font-size: 12px; line-height: 1.25; color: #232324; word-break: break-all; " >
2022年03月03日 16:17
</td>
</tr>
<tr style="">
<td valign="top" style=" width: 4.25em; font-size: 12px; line-height: 1.25; color: #78787a; " >
收件人
</td>
<td valign="top" style=" font-size: 12px; line-height: 1.25; color: #232324; word-break: break-all; " >
<a class="mail-to" style="text-decoration:none;color:#0886e8;" ***@***.******@***.***></a>
</td>
</tr>
<tr style="">
<td valign="top" style=" width: 4.25em; font-size: 12px; line-height: 1.25; color: #78787a; " >
抄送至
</td>
<td valign="top" style=" font-size: 12px; line-height: 1.25; color: #232324; word-break: break-all; " >
<a class="mail-cc" style="text-decoration:none;color:#0886e8;" ***@***.******@***.***></a>
</td>
</tr>
<tr>
<td valign="top" style=" width: 4.25em; font-size: 12px; line-height: 1.25; color: #78787a; " >
主题
</td>
<td class="mail-subject" valign="top" style=" font-size: 12px; line-height: 1.25; color: #232324; word-break: break-all; " >
[storezhang/utils] 项目引用了com.alibaba:fastjson等39个开源组件，存在36个漏洞，建议升级 (Issue #20)
</td>
</tr>
</table>
</div>
<div><p></p>
<p dir="auto">大佬，你好，我是<a class="user-mention" data-hovercard-type="user" data-hovercard-url="/users/abbykimi/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" ***@***.***</a>，我IDE运行您这个项目的时候，提示有几个漏洞，项目调用了com.alibaba:fastjson等39个开源组件，存在36个安全漏洞，建议你升级下。</p>
<pre><code>漏洞标题：Fastjson < 1.2.25版本远程代码执行漏洞
漏洞编号：CVE-2017-18349
漏洞描述：
Fastjson 是Java语言实现的快速JSON解析和生成器，在1.2.25版本之前攻击者可通过精心构造的JSON请求远程执行任意代码。
漏洞原因：
***@***.***字段进行安全性验证，攻击者可以传入危险类，并调用连接远程rmi主机，通过其中的恶意类执行代码。
国家漏洞库信息：https://www.cnvd.org.cn/flaw/show/CNVD-2018-21789
影响范围：(∞, 1.2.25)
最小修复版本：1.2.25
引入路径：
***@***.******@***.******@***.***
</code></pre>
<p dir="auto">另外35个漏洞 ，信息有点多我就不贴了，你自己看下完整报告：<a href="https://www.mfsec.cn/jr?p=if9f38" rel="nofollow">https://www.mfsec.cn/jr?p=if9f38</a></p>
<p dir="auto">如果你对这个issues有任何疑问可以回复我哈( <a class="user-mention" data-hovercard-type="user" data-hovercard-url="/users/abbykimi/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" ***@***.***</a> )，我会及时回复你的。</p>
<p style="font-size:small;-webkit-text-size-adjust:none;color:#666;">—<br />Reply to this email directly, <a href="#20">view it on GitHub</a>, or <a href="https://github.com/notifications/unsubscribe-auth/ABAUTZXEG4OVDMWNVHQUCFTU6BYQDANCNFSM5PZXLFTA">unsubscribe</a>.<br />Triage notifications on the go with GitHub Mobile for <a href="https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675">iOS</a> or <a href="https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub">Android</a>.
<br />You are receiving this because you are subscribed to this thread.<img src="https://github.com/notifications/beacon/ABAUTZVZ2HKFKOPERUBGPCLU6BYQDA5CNFSM5PZXLFTKYY3PNVWWK3TUL52HS4DFUVEXG43VMWVGG33NNVSW45C7NFSM4RIHIBPA.gif" height="1" width="1" alt="" /><span style="color: transparent; font-size: 0; display: none; visibility: hidden; overflow: hidden; opacity: 0; width: 0; height: 0; max-width: 0; max-height: 0; mso-hide: all">Message ID: <span><storezhang/utils/issues/20</span><span>@</span><span>github</span><span>.</span><span>com></span></span></p>
<script type="application/ld+json">[
{
***@***.***": "http://schema.org",
***@***.***": "EmailMessage",
"potentialAction": {
***@***.***": "ViewAction",
"target": "#20",
"url": "#20",
"name": "View Issue"
},
"description": "View this Issue on GitHub",
"publisher": {
***@***.***": "Organization",
"name": "GitHub",
"url": "https://github.com"
}
}
]</script></div>
</div>
</body>
</html>
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
大佬，你好，我是@abbykimi，我IDE运行您这个项目的时候，提示有几个漏洞，项目调用了com.alibaba:fastjson等39个开源组件，存在36个安全漏洞，建议你升级下。
另外35个漏洞 ，信息有点多我就不贴了，你自己看下完整报告：https://www.mfsec.cn/jr?p=if9f38
如果你对这个issues有任何疑问可以回复我哈( @abbykimi )，我会及时回复你的。
The text was updated successfully, but these errors were encountered: