In breve
- CVE-2020-11995 è una vulnerabilità CRITICO (CVSS 9.8) che riguarda org.apache.dubbo:dubbo-parent, dubbo (apache).
- Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 5.9%, superiore al 93.3% delle vulnerabilità.
- Correzione: aggiornare a 2.7.8, 2.6.9 o successiva.
| Package | Affected versions | Patched versions |
|---|
| org.apache.dubbo:dubbo-parent Maven | ≥ 2.7.0, < 2.7.8< 2.6.9
| 2.7.82.6.9
|
| dubbo | ≥ 2.5.0, ≤ 2.5.10≥ 2.6.0, ≤ 2.6.8≥ 2.7.0, ≤ 2.7.7
| No fix yet |
Description
A deserialization vulnerability existed in dubbo 2.7.5 and its earlier versions, which could lead to malicious code execution. Most Dubbo users use Hessian2 as the default serialization/deserialization protool, during Hessian2 deserializing the HashMap object, some functions in the classes stored in HashMap will be executed after a series of program calls, however, those special functions may cause remote command execution. For example, the hashCode() function of the EqualsBean class in rome-1.7.0.jar will cause the remotely load malicious classes and execute malicious code by constructing a malicious request. This issue was fixed in Apache Dubbo 2.6.9 and 2.7.8.
NVD description
A deserialization vulnerability existed in dubbo 2.7.5 and its earlier versions, which could lead to malicious code execution. Most Dubbo users use Hessian2 as the default serialization/deserialization protool, during Hessian2 deserializing the HashMap object, some functions in the classes stored in HasMap will be executed after a series of program calls, however, those special functions may cause remote command execution. For example, the hashCode() function of the EqualsBean class in rome-1.7.0.jar will cause the remotely load malicious classes and execute malicious code by constructing a malicious request. This issue was fixed in Apache Dubbo 2.6.9 and 2.7.8.
Altre vulnerabilità di org.apache.dubbo:dubbo-parent
Vedi tutto →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free