Vulnerability · Published Oct 18, 2022 · Assigned by apache
CVE-2022-39198Apache Dubbo Hession Deserialization Vulnerability Gadgets Bypass
Critical 9.8
In plain English
A critical-severity unsafe deserialization in Apache Dubbo from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.3% (higher than 89% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A deserialization vulnerability existed in dubbo hessian-lite 3.2.12 and its earlier versions, which could lead to malicious code execution. This issue affects Apache Dubbo 2.7.x version 2.7.17 and prior versions; Apache Dubbo 3.0.x version 3.0.11 and prior versions; Apache Dubbo 3.1.x version 3.1.0 and prior versions.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | com.alibaba:hessian-lite | 3.2.13 | GHSA-5qwq-g2hx-r6f7 |
| Maven | org.apache.dubbo:dubbo | 2.7.18 | GHSA-5qwq-g2hx-r6f7 |
| Maven | org.apache.dubbo:dubbo | 3.0.12 | GHSA-5qwq-g2hx-r6f7 |
| Maven | org.apache.dubbo:dubbo | 3.1.1 | GHSA-5qwq-g2hx-r6f7 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Dubbo | Apache Dubbo 2.7.x – through 2.7.17Apache Dubbo 3.0.x – through 3.0.11Apache Dubbo 3.1.x – through 3.1.0 |
Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H