Skip to content

[BUG] 升级fastjson 2.0.62 兼容版本后需要清理相关缓存 #7687

Description

@abel533

使用版本 2.0.62

Image

升级原因:1.2.83 漏洞

Image

【已复现】无需 gadget、黑名单失效--Fastjson 1.2.83 远程代码执行漏洞

问题描述

Image

由于序列化ID不一致,反序列化会出错,因此需要清理缓存,保证版本一致。

这个应该是兼容版本漏掉ID=1L导致的。

报错信息:

java.io.InvalidClassException: com.alibaba.fastjson.JSONArray; local class incompatible: stream classdesc serialVersionUID = 3642856726642946224, local class serialVersionUID = 1
	at java.io.ObjectStreamClass.initNonProxy(ObjectStreamClass.java:699)
	at java.io.ObjectInputStream.readNonProxyDesc(ObjectInputStream.java:2005)
	at java.io.ObjectInputStream.readClassDesc(ObjectInputStream.java:1852)
	at java.io.ObjectInputStream.readOrdinaryObject(ObjectInputStream.java:2186)
	at java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1669)

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions