5.0
Moyenne
CVE-2023-23638 A deserialization vulnerability existed when dubbo generic invoke, which could lead to malicious code execution
Description
A deserialization vulnerability existed when dubbo generic invoke, which could lead to malicious code execution. This issue affects Apache Dubbo 2.7.x version 2.7.21 and prior versions; Apache Dubbo 3.0.x version 3.0.13 and prior versions; Apache Dubbo 3.1.x version 3.1.5 and prior versions.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Apache Dubbo 3.1 | premières → 3.1.5 | Pas de correctif indiqué |
| Apache Dubbo 3.0 | premières → 3.0.13 | Pas de correctif indiqué |
| Apache Dubbo 2.7 | premières → 2.7.21 | Pas de correctif indiqué |
Références
- lists.apache.org lists.apache.org
Chronologie
- Publiée
- Dernière modification
Autres CVE de Apache Dubbo
Les 16 CVE de Apache Dubbo →
CVE-2023-46279
Deserialization of Untrusted Data vulnerability in Apache Dubbo.This issue only affects Apache Dubbo 3.1.5
Non notée
CVE-2023-29234
A deserialization vulnerability existed when decode a malicious package.This issue affects Apache Dubbo: from 3.1.0…
Non notée
CVE-2022-39198
A deserialization vulnerability existed in dubbo hessian-lite 3.2.12 and its earlier versions, which could lead to…
Non notée
CVE-2022-24969
bypass CVE-2021-25640 > In Apache Dubbo prior to 2.6.12 and 2.7.15, the usage of parseURL method will lead to the bypass…
Non notée