[
https://issues.apache.org/jira/browse/KYLIN-6116?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18123743#comment-18123743
]
ASF subversion and git services commented on KYLIN-6116:
--------------------------------------------------------
Commit cbd8912e14cf5f966ffdfc3b49691d4be1f35939 in kylin's branch
refs/heads/kylin5 from Li Yang
[ https://gitbox.apache.org/repos/asf?p=kylin.git;h=cbd8912e14 ]
KYLIN-6116 restrict memcached cache deserialization to allowed classes
Route the memcached transcoder and cache adaptor deserialization through
SerializeUtil's class allowlist so a poisoned memcached item cannot
smuggle an arbitrary object graph through the serialized-flag path.
> Potential unsafe deserialization issue in cache handling
> --------------------------------------------------------
>
> Key: KYLIN-6116
> URL: https://issues.apache.org/jira/browse/KYLIN-6116
> Project: Kylin
> Issue Type: Bug
> Reporter: liyang
> Priority: Major
>
> Security issue reported for Apache Kylin 5.0.3. Public tracking issue only;
> technical details are being handled through the ASF security process.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
