apache / apache/incubator-seata
Fix Fury Serialization Vulnerability & Remove Low-Version Fury Dependency + Residual Code
- Dominant language
- Java
- Stars
- 26k
- Forks
- 8.8k
- Avg merge
- 1d 8h
- Merged PRs (30d)
- 4
Description
### Check Ahead
- [x] I have searched the [issues](https://github.com/seata/seata/issues) of this repository and believe that this is not a duplicate.
- [ ] I am willing to try to implement this feature myself.
### Why you need it?
## Problem Description(问题描述)
### English:
- There is a security vulnerability in the current Fury serialization implementation.
- A low-version Fury dependency needs to be removed along with its residual code.
### 中文:
- 当前Fury序列化实现存在安全漏洞需要修复
- 需要移除一个低版本Fury依赖及其相关残留代码
### How it could be?
_No response_
### Other related information
_No response_
Contributor guide
Research direction
Start by tracing the Fury serialization implementation and locating the dependency declarations for the low-version Fury dependency. Identify the residual code tied to that dependency; done means the vulnerability is addressed, the low-version dependency is removed, and its residual code is gone.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- distributed-systems, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100