Vulnerability · Published Jul 17, 2023 · Assigned by apache

CVE-2023-26512Apache EventMesh RabbitMQ-Connector plugin allows RCE through deserialization of untrusted data

Critical 9.8

In plain English

A critical-severity unsafe deserialization in Apache EventMesh (incubating) RabbitMQ connector from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 72% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)1.4%top 28.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

CWE-502 Deserialization of Untrusted Data at the rabbitmq-connector plugin module in Apache EventMesh (incubating) V1.7.0\V1.8.0 on windows\linux\mac os e.g. platforms allows attackers to send controlled message and remote code execute via rabbitmq messages. Users can use the code under the master branch in project repo to fix this issue, we will release the new version as soon as possible.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Maven	org.apache.eventmesh:eventmesh-connector-rabbitmq	no fix listed	GHSA-fj8f-56wc-q36r

Affected products (as reported)

Vendor	Product	Versions
Apache Software Foundation	Apache EventMesh (incubating) RabbitMQ connector	1.7.0 – through 1.8.0

Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://lists.apache.org/thread/zb1d62wh8o8pvntrnx4t1hj8vz0pm39p vendor-advisory