Not rated
CVE-2023-29234 A deserialization vulnerability existed when decode a malicious package.This issue affects Apache Dubbo: from 3.1.0…
Description
A deserialization vulnerability existed when decode a malicious package.This issue affects Apache Dubbo: from 3.1.0 through 3.1.10, from 3.2.0 through 3.2.4. Users are recommended to upgrade to the latest version, which fixes the issue.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache Dubbo 3.2 | 3.2.0 → 3.2.4 | No fix stated |
| Apache Dubbo 3.1 | 3.1.0 → 3.1.10 | No fix stated |
References
- lists.apache.org lists.apache.org
- www.openwall.com www.openwall.com
Timeline
- Published
- Last modified
Other CVEs of Apache Dubbo
The 16 CVEs of Apache Dubbo →
CVE-2023-46279
Deserialization of Untrusted Data vulnerability in Apache Dubbo.This issue only affects Apache Dubbo 3.1.5
Not rated
CVE-2023-23638
A deserialization vulnerability existed when dubbo generic invoke, which could lead to malicious code execution
5.0
Medium
CVE-2022-39198
A deserialization vulnerability existed in dubbo hessian-lite 3.2.12 and its earlier versions, which could lead to…
Not rated
CVE-2022-24969
bypass CVE-2021-25640 > In Apache Dubbo prior to 2.6.12 and 2.7.15, the usage of parseURL method will lead to the bypass…
Not rated