Apache Dubbo: Bypass deny serialize list check in Apache Dubbo

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2023-46279 · ADVISORY
• apache/dubbo · PACKAGE
• lists.apache.org/thread/zw53nxrkrfswmk9n3sfwxmcj7x030nmo · WEB
• openwall.com/lists/oss-security/2023/12/15/3 · WEB

org.apache.dubbo:dubbo のその他の脆弱性

• CVE-2023-29234緊急 9.8A deserialization vulnerability existed when decode a malicious package.This issue affects Apache Dubbo: from 3.1.0 through 3.1.10, from 3.2…
• CVE-2023-23638緊急 9.8A deserialization vulnerability existed when dubbo generic invoke, which could lead to malicious code execution. This issue affects Apache…
• CVE-2022-39198緊急 9.8A deserialization vulnerability existed in dubbo hessian-lite 3.2.12 and its earlier versions, which could lead to malicious code execution.…
• CVE-2022-24969中 6.1bypass CVE-2021-25640 > In Apache Dubbo prior to 2.6.12 and 2.7.15, the usage of parseURL method will lead to the bypass of the white host c…
• CVE-2021-43297緊急 9.8A deserialization vulnerability existed in dubbo hessian-lite 3.2.11 and its earlier versions, which could lead to malicious code execution.…