PT-2023-5217 · Apache · Apache Eventmesh

Xuxiaoyu · Publicado 2023-07-15 · Atualizado 2025-06-25 · CVE-2023-26512

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache EventMesh (incubating) versions 1.7.0 through 1.8.0

Description The issue is related to the deserialization of untrusted data in the rabbitmq-connector plugin module, allowing attackers to send controlled messages and execute remote code via rabbitmq messages. This can be exploited by attackers to execute arbitrary code.

Recommendations For Apache EventMesh (incubating) versions 1.7.0 through 1.8.0, users can use the code under the master branch in the project repository to fix this issue. A new version with the fix is set to be released as soon as possible. As a temporary workaround, consider restricting access to the rabbitmq-connector plugin module to minimize the risk of exploitation.

Correção

Deserialization of Untrusted Data

Enumeração de Fraquezas

CWE-502

Identificadores relacionados

BDU:2023-05825

CVE-2023-26512

GHSA-FJ8F-56WC-Q36R

Produtos afetados

Apache Eventmesh

Referências · 10

• https://vuldb.com/ru/?id.234227 · Nota
• https://t.me/cvenotify/126619 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-26512 · Nota de Segurança
• https://bdu.fstec.ru/vul/2023-05825 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-26512 · Aviso do Fabricante
• https://lists.apache.org/thread/zb1d62wh8o8pvntrnx4t1hj8vz0pm39p · Aviso do Fabricante
• https://t.me/cibsecurity/66801 · Publicação no Telegram
• https://t.me/cvenotify/54473 · Publicação no Telegram
• https://osv.dev/vulnerability/GHSA-fj8f-56wc-q36r · Aviso do Fabricante
• https://t.me/cvenotify/96845 · Publicação no Telegram