Giter Club home page Giter Club logo

nettyrpc's People

Contributors

gloduck avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar

nettyrpc's Issues

同学,您这个项目引入了53个开源组件,存在12个漏洞,辛苦升级一下

检测到 Gloduck/NettyRpc 一共引入了53个开源组件,存在12个漏洞

漏洞标题:Apache Log4j不可信数据反序列化漏洞 
缺陷组件:log4j:[email protected]
漏洞编号:CVE-2019-17571
漏洞描述:Apache Log4j是美国阿帕奇(Apache)软件基金会的一款基于Java的开源日志记录工具。
Apache Log4j 1.2版本中存在安全漏洞。攻击者可利用该漏洞执行代码。 
国家漏洞库信息:https://www.cnvd.org.cn/flaw/show/CNVD-2020-00502
影响范围:[0, ∞)
最小修复版本:
缺陷组件引入路径:cn.gloduck:[email protected]>org.apache.curator:[email protected]>org.apache.curator:[email protected]>org.apache.zookeeper:[email protected]>log4j:[email protected]

另外还有12个漏洞,详细报告:https://mofeisec.com/jr?p=aeffae

关于心跳机制

为什么客户端发的心跳包,服务端会读不出来呢,报了错误的消息长度

连接关闭

    public <T extends Serializable> byte[] encode(T obj) throws SerializationException {
        Kryo kryo = pool.borrow();
        byte[] bytes;
        try (ByteArrayOutputStream outputStream = new ByteArrayOutputStream(); Output output = new Output(outputStream)){
            kryo.writeObject(output, obj);
            output.flush();
            bytes = outputStream.toByteArray();
        } catch (IOException e){
            throw new SerializationException(e);
        } finally {
            pool.release(kryo);
        }
        return bytes;
    }

序列化器中都没有关闭连接,不会造成内存泄漏吗?

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.