GHSA-6x49-w35h-wqrj

ghsaUSosv

Bypass serialize checks in Apache Dubbo

view advisory published 2023-12-15Licence: CC-BY-4.0

A deserialization vulnerability existed when decode a malicious package.This issue affects Apache Dubbo: from 3.1.0 through 3.1.10, from 3.2.0 through 3.2.4. Users are recommended to upgrade to the latest version, which fixes the issue.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2023-29234US	critical9.8	7.40% (94th)	—	2023-12-15
A deserialization vulnerability existed when decode a malicious package.This issue affects Apache Dubbo: from 3.1.0 through 3.1.10, from 3.2.0 through 3.2.4. Users are recommended…

references

External citations — patches, advisories, analysis.

http://www.openwall.com/lists/oss-security/2023/12/15/2WEB
https://github.com/apache/dubboPACKAGE
https://lists.apache.org/thread/wb2df2whkdnbgp54nnqn0m94rllx8f77WEB
https://nvd.nist.gov/vuln/detail/CVE-2023-29234ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan