Bypass serialize checks in Apache Dubbo

Mô tả

Tham khảo

• nvd.nist.gov/vuln/detail/CVE-2023-29234 · ADVISORY
• apache/dubbo · PACKAGE
• lists.apache.org/thread/wb2df2whkdnbgp54nnqn0m94rllx8f77 · WEB
• openwall.com/lists/oss-security/2023/12/15/2 · WEB

Lỗ hổng khác của org.apache.dubbo:dubbo

• CVE-2023-46279NGHIÊM TRỌNG 9.8Deserialization of Untrusted Data vulnerability in Apache Dubbo.This issue only affects Apache Dubbo 3.1.5. Users are recommended to upgrad…
• CVE-2023-23638NGHIÊM TRỌNG 9.8A deserialization vulnerability existed when dubbo generic invoke, which could lead to malicious code execution. This issue affects Apache…
• CVE-2022-39198NGHIÊM TRỌNG 9.8A deserialization vulnerability existed in dubbo hessian-lite 3.2.12 and its earlier versions, which could lead to malicious code execution.…
• CVE-2022-24969TRUNG BÌNH 6.1bypass CVE-2021-25640 > In Apache Dubbo prior to 2.6.12 and 2.7.15, the usage of parseURL method will lead to the bypass of the white host c…
• CVE-2021-43297NGHIÊM TRỌNG 9.8A deserialization vulnerability existed in dubbo hessian-lite 3.2.11 and its earlier versions, which could lead to malicious code execution.…