Vulnerability · Published Sep 9, 2021 · Assigned by apache
CVE-2021-37579Bypass deserialization checks in Apache Dubbo
Critical 9.8
In plain English
A critical-severity security flaw in Apache Dubbo from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 6.6% (higher than 94% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
The Dubbo Provider will check the incoming request and the corresponding serialization type of this request meet the configuration set by the server. But there's an exception that the attacker can use to skip the security check (when enabled) and reaching a deserialization operation with native java serialization. Apache Dubbo 2.7.13, 3.0.2 fixed this issue by quickly fail when any unrecognized request was found.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.apache.dubbo:dubbo | 2.7.13 | GHSA-q897-9jxf-jg9r |
| Maven | org.apache.dubbo:dubbo | 3.0.2 | GHSA-q897-9jxf-jg9r |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Dubbo | Apache Dubbo 2.7.x – through 2.7.12Apache Dubbo 3.0.x – through 3.0.1 |