PT-2023-5217 · Apache · Apache Eventmesh

Xuxiaoyu · Published 2023-07-15 · Updated 2025-06-25 · CVE-2023-26512

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache EventMesh (incubating) versions 1.7.0 through 1.8.0

Description The issue is related to the deserialization of untrusted data in the rabbitmq-connector plugin module, allowing attackers to send controlled messages and execute remote code via rabbitmq messages. This can be exploited by attackers to execute arbitrary code.

Recommendations For Apache EventMesh (incubating) versions 1.7.0 through 1.8.0, users can use the code under the master branch in the project repository to fix this issue. A new version with the fix is set to be released as soon as possible. As a temporary workaround, consider restricting access to the rabbitmq-connector plugin module to minimize the risk of exploitation.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2023-05825

CVE-2023-26512

GHSA-FJ8F-56WC-Q36R

Affected Products

Apache Eventmesh

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2023-26512 · Security Note
• https://bdu.fstec.ru/vul/2023-05825 · Security Note
• https://osv.dev/vulnerability/CVE-2023-26512 · Vendor Advisory
• https://lists.apache.org/thread/zb1d62wh8o8pvntrnx4t1hj8vz0pm39p · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fj8f-56wc-q36r · Vendor Advisory
• https://vuldb.com/ru/?id.234227 · Note
• https://t.me/cvenotify/126619 · Telegram Post
• https://t.me/cibsecurity/66801 · Telegram Post
• https://t.me/cvenotify/54473 · Telegram Post
• https://t.me/cvenotify/96845 · Telegram Post