CVE-2020-11995
Description
A deserialization vulnerability existed in dubbo 2.7.5 and its earlier versions, which could lead to malicious code execution. Most Dubbo users use Hessian2 as the default serialization/deserialization protool, during Hessian2 deserializing the HashMap object, some functions in the classes stored in HasMap will be executed after a series of program calls, however, those special functions may cause remote command execution. For example, the hashCode() function of the EqualsBean class in rome-1.7.0.jar will cause the remotely load malicious classes and execute malicious code by constructing a malicious request. This issue was fixed in Apache Dubbo 2.6.9 and 2.7.8.
How to fix
- org.apache.dubbo:dubbo-parent2.7.8, 2.6.9 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache dubbo | 2.5.0 ≤ v ≤ 2.5.10, 2.6.0 ≤ v ≤ 2.6.8, 2.7.0 ≤ v ≤ 2.7.7 | — |
| org.apache.dubbo:dubbo-parentMaven | 2.7.0 ≤ v < 2.7.8, v < 2.6.9 | 2.7.8, 2.6.9 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.