PT-2021-18655 · Apache · Apache Dubbo

Published 2021-05-31 · Updated 2022-03-18 · CVE-2021-30180

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Dubbo versions prior to 2.7.9

Description The issue allows arbitrary constructors to be called when parsing YAML rules used for Tag routing. This routing is utilized by customers to direct requests to the appropriate server, relying on rules to find the correct endpoint.

Recommendations For versions prior to 2.7.9, update to version 2.7.9 or later to resolve the issue.

Fix

HTTP Request/Response Smuggling

Code Injection

Weakness Enumeration

CWE-444

CWE-94

Related Identifiers

CVE-2021-30180

GHSA-7WFC-X4F7-GG2X

Affected Products

Apache Dubbo

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2021-30180 · Security Note
• https://osv.dev/vulnerability/CVE-2021-30180 · Vendor Advisory
• https://lists.apache.org/thread.html/raed526465e56204030ddf374b1959478a290e7511971d7aba2e9e39b%40%3Cdev.dubbo.apache.org%3E · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7wfc-x4f7-gg2x · Vendor Advisory
• https://t.me/cybersecuritytechnologies/3699 · Telegram Post