jetcache被动依赖spring-beans,会受到Spring RCE 0day高危漏洞影响吗?
Open
- Dominant language
- Java
- Stars
- 5.6k
- Forks
- 1.1k
- PR merge metrics
- No merged PRs in 30d
Description
jetcache被动依赖spring-beans,会受到Spring RCE 0day高危漏洞影响吗?如果有影响,计划怎么修复?什么时间修复?
说明:Spring框架曝出RCE 0day漏洞。已经证实由于 SerializationUtils#deserialize 基于 Java 的序列化机制,可导致远程代码执行 (RCE)
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by reviewing JetCache's use of the spring-beans dependency and tracing whether SerializationUtils#deserialize is reachable through the project. Check the reported Spring RCE details against that usage; the issue is complete when its impact and an agreed remediation plan are documented.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, spring
- Domain
- backend, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100