Deserialization of Untrusted Data in Apache Dubbo

CVE-2019-17564 → View on GitHub ↗ View on CVE.org ↗ View on NVD ↗

Description

Unsafe deserialization occurs within a Dubbo application which has HTTP remoting enabled. An attacker may submit a POST request with a Java object in it to completely compromise a Provider instance of Apache Dubbo, if this instance enables HTTP. This issue affected Apache Dubbo 2.7.0 to 2.7.4, 2.6.0 to 2.6.7, and all 2.5.x versions.

Basic information

Type
reviewed
Severity
medium
Advisory on GitHub
Open advisory ↗
Repository advisory
—
Source code
Not specified
Published (advisory)
2022-05-24 17:13:14 UTC
Updated
2023-02-02 05:04:14 UTC
GitHub reviewed
2022-11-04 22:36:16 UTC
NVD published
2020-04-01

EPSS Score

Score Percentile
94.05% 99.89%

CVSS Scores

No CVSS scores in this advisory.

Identifiers

Type Value
GHSA GHSA-69wp-3pm3-hxgg ↗
CVE CVE-2019-17564 ↗

CWEs

CWE id Name
CWE-502 Deserialization of Untrusted Data

Affected packages (1)

Vulnerable version ranges and first patched releases as published by GitHub.

Ecosystem Package Vulnerable range First patched Vulnerable functions
maven org.apache.dubbo:dubbo-rpc-http-invoker >= 2.5.0, < 2.7.5 2.7.5 —

References

cvelogic Threat Intelligence