CVE-2022-39198

A deserialization vulnerability existed in dubbo hessian-lite 3.2.12 and its earlier versions, which could lead to malicious code execution. This issue affects Apache Dubbo 2.7.x version 2.7.17 and prior versions; Apache Dubbo 3.0.x version 3.0.11 and prior versions; Apache Dubbo 3.1.x version...

cc.akkaha:pea-dubbo_2.12 (>=0.6.0, <=0.7.0), cc.akkaha:pea_2.12 (>=0.6.0, <=0.7.0) +273 more potentially affected by CVE-2022-39198 via org.apache.dubbo:dubbo (>=2.7.0, <=2.7.17)

org.apache.dubbo:dubbo MAVEN version =2.7.0, =0.6.0, =0.6.0, =1.0.2, =1.0.0, =1.2.1, =1.1.1.release, =1.28.0, =0.1.3, =1.00, =1.19 - cn.org.thinkcloud.quickstart:think-cloud-quickstart-biz-provider 1.0.1.release and more Source cves: CVE-2022-39198 Source advisory: OSV:GHSA-5QWQ-G2HX-R6F7...

CVE-2022-39198

The CVE-2022-39198 entry describes a deserialization vulnerability in dubbo hessian-lite prior to 3.2.12, which could allow arbitrary code execution. Affected software/components include dubbo hessian-lite 3.2.12 and earlier, impacting Apache Dubbo 2.7.x up to 2.7.17; 3.0.x up to 3.0.11; and 3.1....

cloud.tianai.rpc.remoting.codec:rpc-remoting-codec-hessian2 (>=1.0.1, <=1.6.0), cloud.tianai.rpc:rpc-all (>=1.0.1, <=1.5.2) +327 more potentially affected by CVE-2022-39198 via com.alibaba:hessian-lite (>=2.6.2, <=3.2.12)

com.alibaba:hessian-lite MAVEN version =2.6.2, =1.0.1, =1.0.1, =1.0.1, =1.0.2, =2019.06, =2019.06, =2019.06, =2019.06, =2019.06, =2019.06, =0.1.3, =0.2.3, =0.8.0, =0.2.3, =1.6.0-pre and more Source cves: CVE-2022-39198 Source advisory: MEND:CVE-2022-39198...

CVE-2022-39198 Apache Dubbo Hession Deserialization Vulnerability Gadgets Bypass

A deserialization vulnerability existed in dubbo hessian-lite 3.2.12 and its earlier versions, which could lead to malicious code execution. This issue affects Apache Dubbo 2.7.x version 2.7.17 and prior versions; Apache Dubbo 3.0.x version 3.0.11 and prior versions; Apache Dubbo 3.1.x version...