Aller au contenu
en Se connecter
Non notée

CVE-2021-25641 Each Apache Dubbo server will set a serialization id to tell the clients which serialization protocol it is working on

Description

Each Apache Dubbo server will set a serialization id to tell the clients which serialization protocol it is working on. But for Dubbo versions before 2.7.8 or 2.6.9, an attacker can choose which serialization id the Provider will use by tampering with the byte preamble flags, aka, not following the server's instruction. This means that if a weak deserializer such as the Kryo and FST are somehow in code scope (e.g. if Kryo is somehow a part of a dependency), a remote unauthenticated attacker can tell the Provider to use the weak deserializer, and then proceed to exploit it.

Produits et versions touchés

Produit Versions touchées Corrigé en
Apache Dubbo 2.7 premières → < 2.7.8 2.7.8
Apache Dubbo 2.6 premières → < 2.6.9 2.6.9

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de Apache Dubbo

Les 16 CVE de Apache Dubbo →
CVE-2023-46279 Deserialization of Untrusted Data vulnerability in Apache Dubbo.This issue only affects Apache Dubbo 3.1.5 Non notée CVE-2023-29234 A deserialization vulnerability existed when decode a malicious package.This issue affects Apache Dubbo: from 3.1.0… Non notée CVE-2023-23638 A deserialization vulnerability existed when dubbo generic invoke, which could lead to malicious code execution 5.0 Moyenne CVE-2022-39198 A deserialization vulnerability existed in dubbo hessian-lite 3.2.12 and its earlier versions, which could lead to… Non notée
Suivre cette CVE