Maven package
org.apache.dubbo/dubbo
pkg:maven/org.apache.dubbo/dubbo
Vulnerabilities (16)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2023-46279 | — | >= 3.1.5, < 3.1.6 | 3.1.6 | Dec 15, 2023 | Deserialization of Untrusted Data vulnerability in Apache Dubbo.This issue only affects Apache Dubbo 3.1.5. Users are recommended to upgrade to the latest version, which fixes the issue. | ||
| CVE-2023-29234 | — | >= 3.1.0, < 3.1.11 | 3.1.11 | Dec 15, 2023 | A deserialization vulnerability existed when decode a malicious package.This issue affects Apache Dubbo: from 3.1.0 through 3.1.10, from 3.2.0 through 3.2.4. Users are recommended to upgrade to the latest version, which fixes the issue. | ||
| CVE-2023-23638 | — | < 2.7.22 | 2.7.22 | Mar 8, 2023 | A deserialization vulnerability existed when dubbo generic invoke, which could lead to malicious code execution. This issue affects Apache Dubbo 2.7.x version 2.7.21 and prior versions; Apache Dubbo 3.0.x version 3.0.13 and prior versions; Apache Dubbo 3.1.x version 3.1.5 and p | ||
| CVE-2022-39198 | — | >= 2.7.0, < 2.7.18 | 2.7.18 | Oct 18, 2022 | A deserialization vulnerability existed in dubbo hessian-lite 3.2.12 and its earlier versions, which could lead to malicious code execution. This issue affects Apache Dubbo 2.7.x version 2.7.17 and prior versions; Apache Dubbo 3.0.x version 3.0.11 and prior versions; Apache Dubbo | ||
| CVE-2022-24969 | — | >= 2.5.0, < 2.7.15 | 2.7.15 | Jun 6, 2022 | bypass CVE-2021-25640 > In Apache Dubbo prior to 2.6.12 and 2.7.15, the usage of parseURL method will lead to the bypass of the white host check which can cause open redirect or SSRF vulnerability. | ||
| CVE-2021-43297 | — | >= 2.6.0, < 2.6.12 | 2.6.12 | Jan 10, 2022 | A deserialization vulnerability existed in dubbo hessian-lite 3.2.11 and its earlier versions, which could lead to malicious code execution. Most Dubbo users use Hessian2 as the default serialization/deserialization protocol, during Hessian catch unexpected exceptions, Hessian wi | ||
| CVE-2021-37579 | — | < 2.7.13 | 2.7.13 | Sep 9, 2021 | The Dubbo Provider will check the incoming request and the corresponding serialization type of this request meet the configuration set by the server. But there's an exception that the attacker can use to skip the security check (when enabled) and reaching a deserialization operat | ||
| CVE-2021-36161 | — | < 2.7.13 | 2.7.13 | Sep 9, 2021 | Some component in Dubbo will try to print the formated string of the input arguments, which will possibly cause RCE for a maliciously customized bean with special toString method. In the latest version, we fix the toString call in timeout, cache and some other places. Fixed in Ap | ||
| CVE-2021-36163 | — | >= 2.7.0, < 2.7.13 | 2.7.13 | Sep 7, 2021 | In Apache Dubbo, users may choose to use the Hessian protocol. The Hessian protocol is implemented on top of HTTP and passes the body of a POST request directly to a HessianSkeleton: New HessianSkeleton are created without any configuration of the serialization factory and theref | ||
| CVE-2021-36162 | — | < 2.7.13 | 2.7.13 | Sep 7, 2021 | Apache Dubbo supports various rules to support configuration override or traffic routing (called routing in Dubbo). These rules are loaded into the configuration center (eg: Zookeeper, Nacos, ...) and retrieved by the customers when making a request in order to find the right end | ||
| CVE-2021-30180 | — | >= 2.7.0, < 2.7.10 | 2.7.10 | May 31, 2021 | Apache Dubbo prior to 2.7.9 support Tag routing which will enable a customer to route the request to the right server. These rules are used by the customers when making a request in order to find the right endpoint. When parsing these YAML rules, Dubbo customers may enable callin | ||
| CVE-2021-30179 | — | >= 2.5.0, < 2.7.10 | 2.7.10 | May 31, 2021 | Apache Dubbo prior to 2.6.9 and 2.7.9 by default supports generic calls to arbitrary methods exposed by provider interfaces. These invocations are handled by the GenericFilter which will find the service and method specified in the first arguments of the invocation and use the Ja | ||
| CVE-2021-25640 | — | >= 2.5.0, < 2.7.10 | 2.7.10 | May 31, 2021 | In Apache Dubbo prior to 2.6.9 and 2.7.9, the usage of parseURL method will lead to the bypass of white host check which can cause open redirect or SSRF vulnerability. | ||
| CVE-2021-30181 | — | >= 2.5.0, < 2.7.10 | 2.7.10 | May 29, 2021 | Apache Dubbo prior to 2.6.9 and 2.7.9 supports Script routing which will enable a customer to route the request to the right server. These rules are used by the customers when making a request in order to find the right endpoint. When parsing these rules, Dubbo customers use Scri | ||
| CVE-2021-25641 | — | >= 2.5.0, < 2.7.8 | 2.7.8 | May 29, 2021 | Each Apache Dubbo server will set a serialization id to tell the clients which serialization protocol it is working on. But for Dubbo versions before 2.7.8 or 2.6.9, an attacker can choose which serialization id the Provider will use by tampering with the byte preamble flags, aka | ||
| CVE-2020-1948 | — | < 2.7.7 | 2.7.7 | Jul 14, 2020 | This vulnerability can affect all Dubbo users stay on version 2.7.6 or lower. An attacker can send RPC requests with unrecognized service name or method name along with some malicious parameter payloads. When the malicious parameter is deserialized, it will execute some malicious |
- CVE-2023-46279Dec 15, 2023affected >= 3.1.5, < 3.1.6fixed 3.1.6
Deserialization of Untrusted Data vulnerability in Apache Dubbo.This issue only affects Apache Dubbo 3.1.5. Users are recommended to upgrade to the latest version, which fixes the issue.
- CVE-2023-29234Dec 15, 2023affected >= 3.1.0, < 3.1.11fixed 3.1.11
A deserialization vulnerability existed when decode a malicious package.This issue affects Apache Dubbo: from 3.1.0 through 3.1.10, from 3.2.0 through 3.2.4. Users are recommended to upgrade to the latest version, which fixes the issue.
- CVE-2023-23638Mar 8, 2023affected < 2.7.22fixed 2.7.22
A deserialization vulnerability existed when dubbo generic invoke, which could lead to malicious code execution. This issue affects Apache Dubbo 2.7.x version 2.7.21 and prior versions; Apache Dubbo 3.0.x version 3.0.13 and prior versions; Apache Dubbo 3.1.x version 3.1.5 and p
- CVE-2022-39198Oct 18, 2022affected >= 2.7.0, < 2.7.18fixed 2.7.18
A deserialization vulnerability existed in dubbo hessian-lite 3.2.12 and its earlier versions, which could lead to malicious code execution. This issue affects Apache Dubbo 2.7.x version 2.7.17 and prior versions; Apache Dubbo 3.0.x version 3.0.11 and prior versions; Apache Dubbo
- CVE-2022-24969Jun 6, 2022affected >= 2.5.0, < 2.7.15fixed 2.7.15
bypass CVE-2021-25640 > In Apache Dubbo prior to 2.6.12 and 2.7.15, the usage of parseURL method will lead to the bypass of the white host check which can cause open redirect or SSRF vulnerability.
- CVE-2021-43297Jan 10, 2022affected >= 2.6.0, < 2.6.12fixed 2.6.12
A deserialization vulnerability existed in dubbo hessian-lite 3.2.11 and its earlier versions, which could lead to malicious code execution. Most Dubbo users use Hessian2 as the default serialization/deserialization protocol, during Hessian catch unexpected exceptions, Hessian wi
- CVE-2021-37579Sep 9, 2021affected < 2.7.13fixed 2.7.13
The Dubbo Provider will check the incoming request and the corresponding serialization type of this request meet the configuration set by the server. But there's an exception that the attacker can use to skip the security check (when enabled) and reaching a deserialization operat
- CVE-2021-36161Sep 9, 2021affected < 2.7.13fixed 2.7.13
Some component in Dubbo will try to print the formated string of the input arguments, which will possibly cause RCE for a maliciously customized bean with special toString method. In the latest version, we fix the toString call in timeout, cache and some other places. Fixed in Ap
- CVE-2021-36163Sep 7, 2021affected >= 2.7.0, < 2.7.13fixed 2.7.13
In Apache Dubbo, users may choose to use the Hessian protocol. The Hessian protocol is implemented on top of HTTP and passes the body of a POST request directly to a HessianSkeleton: New HessianSkeleton are created without any configuration of the serialization factory and theref
- CVE-2021-36162Sep 7, 2021affected < 2.7.13fixed 2.7.13
Apache Dubbo supports various rules to support configuration override or traffic routing (called routing in Dubbo). These rules are loaded into the configuration center (eg: Zookeeper, Nacos, ...) and retrieved by the customers when making a request in order to find the right end
- CVE-2021-30180May 31, 2021affected >= 2.7.0, < 2.7.10fixed 2.7.10
Apache Dubbo prior to 2.7.9 support Tag routing which will enable a customer to route the request to the right server. These rules are used by the customers when making a request in order to find the right endpoint. When parsing these YAML rules, Dubbo customers may enable callin
- CVE-2021-30179May 31, 2021affected >= 2.5.0, < 2.7.10fixed 2.7.10
Apache Dubbo prior to 2.6.9 and 2.7.9 by default supports generic calls to arbitrary methods exposed by provider interfaces. These invocations are handled by the GenericFilter which will find the service and method specified in the first arguments of the invocation and use the Ja
- CVE-2021-25640May 31, 2021affected >= 2.5.0, < 2.7.10fixed 2.7.10
In Apache Dubbo prior to 2.6.9 and 2.7.9, the usage of parseURL method will lead to the bypass of white host check which can cause open redirect or SSRF vulnerability.
- CVE-2021-30181May 29, 2021affected >= 2.5.0, < 2.7.10fixed 2.7.10
Apache Dubbo prior to 2.6.9 and 2.7.9 supports Script routing which will enable a customer to route the request to the right server. These rules are used by the customers when making a request in order to find the right endpoint. When parsing these rules, Dubbo customers use Scri
- CVE-2021-25641May 29, 2021affected >= 2.5.0, < 2.7.8fixed 2.7.8
Each Apache Dubbo server will set a serialization id to tell the clients which serialization protocol it is working on. But for Dubbo versions before 2.7.8 or 2.6.9, an attacker can choose which serialization id the Provider will use by tampering with the byte preamble flags, aka
- CVE-2020-1948Jul 14, 2020affected < 2.7.7fixed 2.7.7
This vulnerability can affect all Dubbo users stay on version 2.7.6 or lower. An attacker can send RPC requests with unrecognized service name or method name along with some malicious parameter payloads. When the malicious parameter is deserialized, it will execute some malicious