Description
Deserialization of untrusted data vulnerability that may allow class-registration checks to be bypassed during Java lambda deserialization. Only lambda capture class is affected
This issue affects Apache Fory: from before 1.4.0.
Users are recommended to upgrade to version 1.4.0, which fixes the issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache Fory | 0.11.0 – < 1.4.0, 0.5.0 – < 0.11.0 | 1.4.0 |
References
- https://lists.apache.org/thread/py6fbvm9nk1gxdd85rbzbozwzfh0jrsc vendor-advisory