GitHub Advisoryadvisory · Maven

GHSA-q897-9jxf-jg9r Security check skip in Apache Dubbo

CRITICAL Published 2021-09-10 Modified 2021-09-20 Official page ↗
Aliases
CVE-2021-37579
Ecosystem
Maven
Packages
org.apache.dubbo:dubbo
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-502
Reviewed
2021-09-10

Affected packages

• Maven org.apache.dubbo:dubbo: < 2.7.13 → fixed in 2.7.13 • Maven org.apache.dubbo:dubbo: >= 3.0.0, < 3.0.2 → fixed in 3.0.2

Description

The Dubbo Provider will check the incoming request and the corresponding serialization type of this request meet the configuration set by the server. But there's an exception that the attacker can use to skip the security check (when enabled) and reaching a deserialization operation with native java serialization. Apache Dubbo 2.7.13, 3.0.2 fixed this issue by quickly fail when any unrecognized request was found.

Related

Alias · CVE (1)

  • CVE-2021-37579 The Dubbo Provider will check the incoming request and the corresponding serialization type of this request meet the configuration set by… vulnerability

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References