GHSA-7wfc-x4f7-gg2x
Code injection in Apache Dubbo
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | org.apache.dubbo:dubbo | >= 2.7.0, < 2.7.10 | 2.7.10 |
Details
As written in the advisory (Markdown source, shown as plain text).
Apache Dubbo prior to 2.7.9 support Tag routing which will enable a customer to route the request to the right server. These rules are used by the customers when making a request in order to find the right endpoint. When parsing these YAML rules, Dubbo customers may enable calling arbitrary constructors.
References
External links from the advisory. They lead to third-party sites.