GitHub Advisoryadvisory · Maven

GHSA-933g-v89r-x8pf Apache Dubbo vulnerable to Deserialization of Untrusted Data

CRITICAL Published 2023-03-08 Modified 2023-03-14 Official page ↗
Aliases
CVE-2023-23638
Ecosystem
Maven
Packages
org.apache.dubbo:dubbo
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-502
Reviewed
2023-03-08

Affected packages

• Maven org.apache.dubbo:dubbo: < 2.7.22 → fixed in 2.7.22 • Maven org.apache.dubbo:dubbo: >= 3.0.0, < 3.0.13 → fixed in 3.0.13 • Maven org.apache.dubbo:dubbo: >= 3.1.0, < 3.1.5 → fixed in 3.1.5

Description

A deserialization vulnerability existed when dubbo generic invoke, which could lead to malicious code execution. This issue affects Apache Dubbo 2.7.x version 2.7.21 and prior versions; Apache Dubbo 3.0.x version 3.0.13 and prior versions; Apache Dubbo 3.1.x version 3.1.5 and prior versions.

Related

Alias · CVE (1)

  • CVE-2023-23638 A deserialization vulnerability existed when dubbo generic invoke, which could lead to malicious code execution. vulnerability

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References