安全通告-涉及MR6D产品漏洞修复公告

该漏洞被海信商显内部测试人员发现。

更新fastjson 2.0.32

MR6D_N0721

The package com.alibaba:fastjson before 1.2.83 are vulnerable to Deserialization of Untrusted Data by bypassing the default autoType shutdown restrictions, which is possible under certain conditions. Exploiting this vulnerability allows attacking remote servers. Workaround: If upgrading is not possible, you can enable [safeMode](https://github.com/alibaba/fastjson/wiki/fastjson_safemode).

低于1.2.83 的 com.alibaba：fastjson 包通过绕过默认的 autoType 关闭限制，容易受到不受信任数据的反序列化，这在某些情况下是可能的。利用此漏洞可以攻击远程服务器。

CVSS v3.1: 9.8 CRITICAL

MR6D_N0616