KCenter
KCenter copied to clipboard
Security fix: Resolve FastJSON deserialization vulnerability (GHSL-20…
…24-282)
- Upgrade FastJSON from 1.2.68 to 2.0.60 for enhanced security
- Remove dangerous ParserConfig.setAutoTypeSupport(true) calls
- Eliminate deserialization of untrusted data vulnerability
- Maintain backward compatibility using com.alibaba.fastjson imports
- FastJSON 2.0.60 has autoType disabled by default, preventing RCE
Fixes security vulnerability where attackers could exploit autoType setting to instantiate arbitrary classes and potentially execute remote code through malicious JSON payloads.