GHSA-933g-v89r-x8pf
Apache Dubbo vulnerable to Deserialization of Untrusted Data
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | org.apache.dubbo:dubbo | < 2.7.22 | 2.7.22 |
| Maven | org.apache.dubbo:dubbo | >= 3.0.0, < 3.0.13 | 3.0.13 |
| Maven | org.apache.dubbo:dubbo | >= 3.1.0, < 3.1.5 | 3.1.5 |
Details
As written in the advisory (Markdown source, shown as plain text).
A deserialization vulnerability existed when dubbo generic invoke, which could lead to malicious code execution. This issue affects Apache Dubbo 2.7.x version 2.7.21 and prior versions; Apache Dubbo 3.0.x version 3.0.13 and prior versions; Apache Dubbo 3.1.x version 3.1.5 and prior versions.
References
External links from the advisory. They lead to third-party sites.