GitHub Advisoryadvisory · Maven

GHSA-ffvr-gmp3-xx43 Apache EventMesh: raft Hessian Deserialization Vulnerability allowing remote code execution

CRITICAL Published 2025-02-14 Modified 2025-02-19 Official page ↗
Aliases
CVE-2024-56180
Ecosystem
Maven
Packages
org.apache.eventmesh:eventmesh-meta-raft
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-502
Reviewed
2025-02-19

Affected packages

• Maven org.apache.eventmesh:eventmesh-meta-raft: >= 1.10.1, < 1.11.0 → fixed in 1.11.0

Description

CWE-502 Deserialization of Untrusted Data at the eventmesh-meta-raft plugin module in Apache EventMesh master branch without release version on windows\linux\mac os e.g. platforms allows attackers to send controlled message and remote code execute via hessian deserialization rpc protocol. Users can use the code under the master branch in project repo or version 1.11.0 to fix this issue.

Related

Alias · CVE (1)

  • CVE-2024-56180 CWE-502 Deserialization of Untrusted Data at the eventmesh-meta-raft plugin module in Apache EventMesh master branch without release… vulnerability

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References