Skip to content
fr Sign in
Not rated

CVE-2021-25641 Each Apache Dubbo server will set a serialization id to tell the clients which serialization protocol it is working on

Description

Each Apache Dubbo server will set a serialization id to tell the clients which serialization protocol it is working on. But for Dubbo versions before 2.7.8 or 2.6.9, an attacker can choose which serialization id the Provider will use by tampering with the byte preamble flags, aka, not following the server's instruction. This means that if a weak deserializer such as the Kryo and FST are somehow in code scope (e.g. if Kryo is somehow a part of a dependency), a remote unauthenticated attacker can tell the Provider to use the weak deserializer, and then proceed to exploit it.

Affected products and versions

Product Affected versions Fixed in
Apache Dubbo 2.7 earliest → < 2.7.8 2.7.8
Apache Dubbo 2.6 earliest → < 2.6.9 2.6.9

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Apache Dubbo

The 16 CVEs of Apache Dubbo →
CVE-2023-46279 Deserialization of Untrusted Data vulnerability in Apache Dubbo.This issue only affects Apache Dubbo 3.1.5 Not rated CVE-2023-29234 A deserialization vulnerability existed when decode a malicious package.This issue affects Apache Dubbo: from 3.1.0… Not rated CVE-2023-23638 A deserialization vulnerability existed when dubbo generic invoke, which could lead to malicious code execution 5.0 Medium CVE-2022-39198 A deserialization vulnerability existed in dubbo hessian-lite 3.2.12 and its earlier versions, which could lead to… Not rated
Track this CVE