apache / apache/incubator-seata

Fix Fury Serialization Vulnerability & Remove Low-Version Fury Dependency + Residual Code

Open
#7,724 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
26k
Forks
8.8k
Avg merge
1d 8h
Merged PRs (30d)
4

Description

### Check Ahead

- [x] I have searched the [issues](https://github.com/seata/seata/issues) of this repository and believe that this is not a duplicate.

- [ ] I am willing to try to implement this feature myself.

### Why you need it?

## Problem Description(问题描述)
### English:
- There is a security vulnerability in the current Fury serialization implementation.
- A low-version Fury dependency needs to be removed along with its residual code.

### 中文:
- 当前Fury序列化实现存在安全漏洞需要修复
- 需要移除一个低版本Fury依赖及其相关残留代码

### How it could be?

_No response_

### Other related information

_No response_

Contributor guide

Open the contributing guide

Research direction

Start by tracing the Fury serialization implementation and locating the dependency declarations for the low-version Fury dependency. Identify the residual code tied to that dependency; done means the vulnerability is addressed, the low-version dependency is removed, and its residual code is gone.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
distributed-systems, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.