CVE-2024-46983

描述

### Impact SOFA Hessian protocol uses a blacklist mechanism to restrict deserialization of potentially dangerous classes for security protection. But there is a gadget chain that can bypass the SOFA Hessian blacklist protection mechanism, and this gadget chain only relies on JDK and does not rely on any third-party components. ### Patches Fixed this issue by update blacklist, users can upgrade to sofahessian version 3.5.5 to avoid this issue. ### Workarounds You can maintain a blacklist yourself in this directory `external/serialize.blacklist`.

如何修補 CVE-2024-46983

要修補 CVE-2024-46983,請將受影響套件升級到下列已修補版本。

• —升級至 3.5.5 或更新版本

CVE-2024-46983 正在被利用嗎?

低 — EPSS 為 0.2%,目前沒有觀察到大規模利用活動。

受影響套件(1)

• from 0, < 3.5.5

CVSS 分數

參考連結(4)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2024-46983
• PATCHgithub.com/sofastack/sofa-hessian
• WEBgithub.com/sofastack/sofa-hessian/commit/764ef4b216aee6aeb4b111aec8947a4e8b53bb87
• WEBgithub.com/sofastack/sofa-hessian/security/advisories/GHSA-c459-2m73-67hj