com.alipay.sofa:hessian@3.5.0-beta1 vulnerabilities
latest version
3.5.5
latest non vulnerable version
first published
7 years ago
latest version published
1 years ago
licenses detected
- [3.3.0,)
package registry
Direct Vulnerabilities
Known vulnerabilities in the com.alipay.sofa:hessian package. This does not include vulnerabilities belonging to this package’s dependencies.
Fix vulnerabilities automatically
Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.
Fix for free| Vulnerability | Vulnerable Version |
|---|---|
com.alipay.sofa:hessian is a binary serialization protocol. Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the blacklist protection mechanism. An attacker can execute arbitrary code by exploiting a gadget chain that bypasses the blacklist restrictions. Note: This is only exploitable if the environment relies solely on JDK without additional third-party components. How to fix Deserialization of Untrusted Data? Upgrade | [,3.5.5) |
com.alipay.sofa:hessian is a binary serialization protocol. Affected versions of this package are vulnerable to Deserialization of Untrusted Data. An attacker could execute arbitrary commands via a crafted serialized Hessian object because blacklisting of the How to fix Deserialization of Untrusted Data? Upgrade | [0,4.0.3) |