亚洲狼友综合在线导航|国产在线拍揄自揄拍无码男男|跪求一个免费的黄色在线网址|国产r级片在线观看完整版视频|国产欧美亚洲日本视频|视频成人一二区啊轻点插|免费观看!毛片久热久|欧美成人高清导航|无码高清色情97视频在线|精品黄色成人网站在线观看

Service Notices

All Notices > Security Notices > Nacos Jraft Hessian Deserialization Remote Code Execution Vulnerability

Nacos Jraft Hessian Deserialization Remote Code Execution Vulnerability

Jun 12, 2023 GMT+08:00

I. Overview

Recently, Nacos has released an updated version to fix a deserialization remote code execution vulnerability. When processing Jraft-based requests, the Nacos cluster uses hessian for deserialization, but does not restrict the deserialization class, which may allow remote code execution. Currently, the vulnerability exploitation details have been disclosed, and the risk is high.

Nacos is an open-source distributed service discovery, configuration, and management platform. If you are a Nacos user, check your system and implement timely security hardening.

II. Severity

Severity: important

(Severity: low, moderate, important, and critical)

III. Affected Products

Affected versions:

1.4.0 <= Nacos < 1.4.6

2.0.0 <= Nacos < 2.2.3

Secure versions:

Nacos 1.4.6

Nacos 2.2.3

IV. Vulnerability Handling

This vulnerability has been fixed in the latest official version. If your service version falls into the affected range, upgrade it to the secure version.

https://github.com/alibaba/nacos/releases/tag/1.4.6

https://github.com/alibaba/nacos/releases/tag/2.2.3

Mitigation measures:

The vulnerability only affects port 7848 (by default), which is typically used as the communication port for Nacos cluster inter-raft protocol and does not handle client requests. Therefore, the risk can be controlled by disabling requests from outside of Nacos clusters in earlier versions.

Huawei Cloud HSS (new version) can detect this vulnerability. Huawei Cloud HSS users can log in to the HSS console to detect host vulnerabilities. For details, see HSS Vulnerability Scan.

Note: Before fixing vulnerabilities, back up your files and conduct a thorough test.