GitHub Advisoryadvisory · Maven

GHSA-97rv-88gf-phvr Apache Dubbo: Bypass deny serialize list check in Apache Dubbo

CRITICAL Published 2023-12-15 Modified 2025-02-13 Official page ↗
Aliases
CVE-2023-46279
Ecosystem
Maven
Packages
org.apache.dubbo:dubbo
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-502
Reviewed
2023-12-15

Affected packages

• Maven org.apache.dubbo:dubbo: >= 3.1.5, < 3.1.6 → fixed in 3.1.6

Description

Deserialization of Untrusted Data vulnerability in Apache Dubbo.This issue only affects Apache Dubbo 3.1.5. Users are recommended to upgrade to the latest version, which fixes the issue.

Related

Alias · CVE (1)

  • CVE-2023-46279 Deserialization of Untrusted Data vulnerability in Apache Dubbo.This issue only affects Apache Dubbo 3.1.5. vulnerability

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References