~ / search / GHSA-69wp-3pm3-hxgg

GHSA-69wp-3pm3-hxgg

Deserialization of Untrusted Data in Apache Dubbo

Source: GitHub Advisory Database (reviewed) Moderate CVE-2019-17564

Packages

EcosystemPackageAffectedFixed in
Maven org.apache.dubbo:dubbo-rpc-http-invoker >= 2.5.0, < 2.7.5 2.7.5

Details

As written in the advisory (Markdown source, shown as plain text).

Unsafe deserialization occurs within a Dubbo application which has HTTP remoting enabled. An attacker may submit a POST request with a Java object in it to completely compromise a Provider instance of Apache Dubbo, if this instance enables HTTP. This issue affected Apache Dubbo 2.7.0 to 2.7.4, 2.6.0 to 2.6.7, and all 2.5.x versions.

References

External links from the advisory. They lead to third-party sites.