Vulnerability · Published Jan 11, 2021 · Assigned by apache
CVE-2020-11995Apache Dubbo default deserialization protocol Hessian2 cause CRE
Critical 9.8
In plain English
A critical-severity unsafe deserialization in Apache Dubbo from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 5.9% (higher than 93% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A deserialization vulnerability existed in dubbo 2.7.5 and its earlier versions, which could lead to malicious code execution. Most Dubbo users use Hessian2 as the default serialization/deserialization protool, during Hessian2 deserializing the HashMap object, some functions in the classes stored in HasMap will be executed after a series of program calls, however, those special functions may cause remote command execution. For example, the hashCode() function of the EqualsBean class in rome-1.7.0.jar will cause the remotely load malicious classes and execute malicious code by constructing a malicious request. This issue was fixed in Apache Dubbo 2.6.9 and 2.7.8.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.apache.dubbo:dubbo-parent | 2.7.8 | GHSA-74mg-6xqx-2vrq |
| Maven | org.apache.dubbo:dubbo-parent | 2.6.9 | GHSA-74mg-6xqx-2vrq |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Dubbo | Apache Dubbo – before 2.6.9 |
Weakness: CWE-502