GitHub Advisoryadvisory · Maven

GHSA-pfwp-8pq4-g7pv Incomplete List of Disallowed Inputs in SOFA-Hessian

CRITICAL Published 2019-03-06 Modified 2024-03-21 Official page ↗
Aliases
CVE-2019-9212
Ecosystem
Maven
Packages
com.alipay.sofa:hessian
Severity
Critical
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-184, CWE-502
Reviewed
2020-06-16

Affected packages

• Maven com.alipay.sofa:hessian: >= 4.0.0, < 4.0.2 → fixed in 4.0.2 • Maven com.alipay.sofa:hessian: < 3.3.6 → fixed in 3.3.6

Description

SOFA-Hessian through 4.0.2 allows remote attackers to execute arbitrary commands via a crafted serialized Hessian object because blacklisting of com.caucho.naming.QName and com.sun.org.apache.xpath.internal.objects.XString is mishandled, related to Resin Gadget.

Related

Alias · CVE (1)

  • CVE-2019-9212 SOFA-Hessian through 4.0.2 allows remote attackers to execute arbitrary commands via a crafted serialized Hessian object because… vulnerability

Weakness · CWE (2)

  • CWE-184 Incomplete List of Disallowed Inputs weakness
  • CWE-502 Deserialization of Untrusted Data weakness

References