Lucene search
GoogleOSV:GHSA-69WP-3PM3-HXGGHistoryMay 24, 2022 - 5:13 p.m.
Deserialization of Untrusted Data in Apache Dubbo
2022-05-2417:13:14
Google
osv.dev
4
0.029 Low
EPSS
Percentile
90.9%
Unsafe deserialization occurs within a Dubbo application which has HTTP remoting enabled. An attacker may submit a POST request with a Java object in it to completely compromise a Provider instance of Apache Dubbo, if this instance enables HTTP. This issue affected Apache Dubbo 2.7.0 to 2.7.4, 2.6.0 to 2.6.7, and all 2.5.x versions.
| CPE | Name | Operator | Version |
|---|---|---|---|
| org.apache.dubbo:dubbo-rpc-http-invoker | eq | 2.7.4 | |
| org.apache.dubbo:dubbo-rpc-http-invoker | eq | 2.7.4.1 |
References
advisory.checkmarx.net/advisory/CX-2020-4275
github.com/apache/dubbo/commit/9b18fe228971eaeca9b87d7b7e95df1c2a8ff91b
github.com/apache/dubbo/releases/tag/dubbo-2.7.5
lists.apache.org/thread.html/r13f7a58fa5d61d729e538a378687118e00c3e229903ba1e7b3a807a2%40%3Cdev.dubbo.apache.org%3E
nvd.nist.gov/vuln/detail/CVE-2019-17564
Related
osv
osv
CVE-2019-17564
2020-04-01 22:15:15
nvd
nvd
CVE-2019-17564
2020-04-01 22:15:15
githubexploit
githubexploit
Exploit for Deserialization of Untrusted Data in Apache Dubbo
2020-02-24 07:46:36
Exploit for Deserialization of Untrusted Data in Apache Dubbo
2020-02-20 08:28:55
Exploit for Deserialization of Untrusted Data in Apache Dubbo
2020-02-12 04:55:51
prion
prion
Deserialization of untrusted data
2020-04-01 22:15:00
cvelist
cvelist
CVE-2019-17564
2020-04-01 21:17:59
github
github
Deserialization of Untrusted Data in Apache Dubbo
2022-05-24 17:13:14
cve
cve
CVE-2019-17564
2020-04-01 22:15:15
checkpoint_advisories
checkpoint_advisories
Apache Dubbo Insecure Deserialization (CVE-2019-17564)
2020-03-11 00:00:00