CVE-2021-43297
Critical
Description
A deserialization vulnerability existed in dubbo hessian-lite 3.2.11 and its earlier versions, which could lead to malicious code execution. Most Dubbo users use Hessian2 as the default serialization/deserialization protocol, during Hessian catch unexpected exceptions, Hessian will log out some imformation for users, which may cause remote command execution. This issue affects Apache Dubbo Apache Dubbo 2.6.x versions prior to 2.6.12; Apache Dubbo 2.7.x versions prior to 2.7.15; Apache Dubbo 3.0.x versions prior to 3.0.5.
SeverityCritical
CVSS9.8
Exploit probability—
Product
Apache Dubbo
PublishedJan 10, 2022
First seenJan 10, 2022
Weakness typeCWE-502Deserialization of untrusted data
How to fix
Update
- apache dubbo2.6.12, 2.7.15, 3.0.5 or later
- org.apache.dubbo:dubbo2.6.12, 2.7.15, 3.0.5 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache dubbo | 2.6.0 ≤ v < 2.6.12, 2.7.0 ≤ v < 2.7.15, 3.0.0 ≤ v < 3.0.5 | 2.6.12, 2.7.15, 3.0.5 |
| org.apache.dubbo:dubboMaven | 2.6.0 ≤ v < 2.6.12, 2.7.0 ≤ v < 2.7.15, 3.0.0 ≤ v < 3.0.5 | 2.6.12, 2.7.15, 3.0.5 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.