PT-2023-7948 · Apache · Apache Dubbo

Bofei Chen + 4 · Published 2023-12-15 · Updated 2023-12-21 · CVE-2023-29234

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Dubbo versions 3.1.0 through 3.1.10 Apache Dubbo versions 3.2.0 through 3.2.4

Description A deserialization vulnerability exists when decoding a malicious package, which can allow a remote attacker to execute arbitrary code or cause a denial of service. The issue is related to shortcomings in the deserialization mechanism of the Apache Dubbo RPC framework.

Recommendations For Apache Dubbo versions 3.1.0 through 3.1.10, upgrade to the latest version to fix the issue. For Apache Dubbo versions 3.2.0 through 3.2.4, upgrade to the latest version to fix the issue. As a temporary workaround, consider restricting the decoding of packages to minimize the risk of exploitation.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2023-09032

CVE-2023-29234

GHSA-6X49-W35H-WQRJ

Affected Products

Apache Dubbo

References · 15

• https://nvd.nist.gov/vuln/detail/CVE-2023-29234 · Security Note
• https://osv.dev/vulnerability/GHSA-6x49-w35h-wqrj · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-29234 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-09032 · Security Note
• https://lists.apache.org/thread/wb2df2whkdnbgp54nnqn0m94rllx8f77 · Vendor Advisory
• https://github.com/apache/dubbo · Note
• https://twitter.com/Dinosn/status/1737054293419499819 · Twitter Post
• https://twitter.com/RedPacketSec/status/1737776270945947988 · Twitter Post
• https://twitter.com/CVEnew/status/1735580254083916283 · Twitter Post
• http://openwall.com/lists/oss-security/2023/12/15/2 · Note
• https://twitter.com/zoomeye_team/status/1737673793882177937 · Twitter Post
• https://t.me/cvenotify/64617 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1735606504487612679 · Twitter Post
• https://twitter.com/the_yellow_fall/status/1735588053316686304 · Twitter Post
• https://twitter.com/oss_security/status/1735580204083429526 · Twitter Post