Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1oM2o4LWZyNXEtOHJmcs4AAo7l

JFinal Java Deserialization Vulnerability

In applications using jfinal 4.9.08 and below, there is a deserialization vulnerability when using redis which can lead to remote code execution

Permalink: https://github.com/advisories/GHSA-h3j8-fr5q-8rfr
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1oM2o4LWZyNXEtOHJmcs4AAo7l
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Critical
Classification: General
Published: almost 2 years ago
Updated: 10 months ago

Identifiers: GHSA-h3j8-fr5q-8rfr, CVE-2021-31649
References:

• https://nvd.nist.gov/vuln/detail/CVE-2021-31649
• http://note.youdao.com/noteshare?id=787ccbb8345dbd4a905aebe35f1d8aa8&sub=6C5C072C901949429EFD978405212FA4
• https://github.com/jfinal/jfinal/issues/184
• https://github.com/advisories/GHSA-h3j8-fr5q-8rfr

Repository: https://github.com/jfinal/jfinal
Blast Radius: 0.0

Affected Packages