blog.csdn

Java ObjectInputStream 详解：从基础用法到反序列化安全

本内容遵循CC 4.0 BY-SA版权协议 在 Java 的 I/O 体系中，ObjectInputStream 是一个非常重要的类。它负责将之前通过 ObjectOutputStream 序列化写入的字节流，重新还原为 Java 对象。这个过程被称为反序列化（Deserialization）。 无论是本地缓存、网络传输，还是分布式系统中的 ...
搜狐

Apache Log4j2 新漏洞 可绕过反序列化允许列表实现远程代码执行

Apache Log4j2最新披露的一个问题可使攻击者在特定部署环境中绕过反序列化允许列表，实现远程代码执行。 该问题编号为Log4j2 #4255，影响通过网络可达的Java反序列化路径接收序列化Log4j事件的应用。 该漏洞与Log4j的FilteredObjectInputStream有关，这是一个用于限制读取 ...
cybersecuritynews

New Apache Log4j2 Flaw Lets Attackers Bypass Security Checks and Execute Remote Code

A newly disclosed Apache Log4j2 issue could allow attackers to bypass a deserialization allowlist and execute code remotely in narrowly defined deployments. The issue, tracked as Log4j2 #4255, affects ...
Security Boulevard

A Reported Log4j RCE Is More Complicated Than It Looks

A recently circulated Log4j finding demonstrates a reproducible bypass of a defense-in-depth deserialization control involving FilteredObjectInputStream. Sonatype does not currently consider this a ...
ccb.belgium.be

Warning: Apache Log4j2 Java Deserialization Filter Bypass Could Enable Remote Code ...

Affected software: Affected software: Apache Log4j2 log4j-api 2.11.0–2.26.1 and log4j-core 2.8.0–2.26.1, when used in affected serialized LogEvent receiver configurations A newly disclosed weakness in ...
51CTO

用300行代码带你手写简化版RPC框架

如果说 RPC 的基础能力是“让远程调用像本地调用一样简单”，那熔断降级解决的就是另一个更现实的问题：当远程调用不可靠时，如何让系统尽量不要一起倒下。这也是为什么真正的 RPC 框架，从来不只是封装网络请求这么简单。 本文会参考 Dubbo 的整体设计 ...
rapid7

Rapid7 Analysis: CVE-2023-0669

On February 1, 2023, Fortra (formerly HelpSystems) posted a security advisory for a remote pre-authentication remote code execution vulnerability in their GoAnywhere MFT managed file transfer solution ...
note

ソフトウェア・データ整合性の失敗

CI/CDパイプラインのアクセス権を最小化し、不正な変更を検知できるようにする デシリアライズするデータには署名検証を行い、信頼できるソースからのみ受け付ける ダウンロードするファイルのハッシュ値（チェックサム）を検証する コードレビュー ...
InfoWorld

Basic and advanced Java serialization

Serialization is the process of converting a Java object into a sequence of bytes so they can be written to disk, sent over a network, or stored outside of memory. Later, the Java virtual machine (JVM ...