alibaba / alibaba/jetcache

jetcache被动依赖spring-beans,会受到Spring RCE 0day高危漏洞影响吗?

Open
#643 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
5.6k
Forks
1.1k
PR merge metrics
No merged PRs in 30d

Description

jetcache被动依赖spring-beans,会受到Spring RCE 0day高危漏洞影响吗?如果有影响,计划怎么修复?什么时间修复?
说明:Spring框架曝出RCE 0day漏洞。已经证实由于 SerializationUtils#deserialize 基于 Java 的序列化机制,可导致远程代码执行 (RCE)

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by reviewing JetCache's use of the spring-beans dependency and tracing whether SerializationUtils#deserialize is reachable through the project. Check the reported Spring RCE details against that usage; the issue is complete when its impact and an agreed remediation plan are documented.

Written by the indexing model from the issue text.

Assessment

Tech stack
java, spring
Domain
backend, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.