GHSA-pfwp-8pq4-g7pv
Incomplete List of Disallowed Inputs in SOFA-Hessian
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | com.alipay.sofa:hessian | >= 4.0.0, < 4.0.2 | 4.0.2 |
| Maven | com.alipay.sofa:hessian | < 3.3.6 | 3.3.6 |
Details
As written in the advisory (Markdown source, shown as plain text).
SOFA-Hessian through 4.0.2 allows remote attackers to execute arbitrary commands via a crafted serialized Hessian object because blacklisting of com.caucho.naming.QName and com.sun.org.apache.xpath.internal.objects.XString is mishandled, related to Resin Gadget.
References
External links from the advisory. They lead to third-party sites.