CVE-2023-29234 Security Details

CVE ID

CVE-2023-29234

CWE

CWE-502

CVE Description

A deserialization vulnerability existed when decode a malicious package.This issue affects Apache Dubbo: from 3.1.0 through 3.1.10, from 3.2.0 through 3.2.4. Users are recommended to upgrade to the latest version, which fixes the issue.

Published

Dec 15, 2023

CVSS Score & Severity

9.8Critical

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score

88.971%

Malware

malware

KEV Status

Not in KEV Catalog: No known exploits

Vulnerable Methods

com/alibaba/dubbo/rpc/protocol/dubbo/DecodeableRpcResult.decode(Lcom/alibaba/dubbo/remoting/Channel;Ljava/io/InputStream;)Ljava/lang/Object;

JVMVulnerable params: 1

org/apache/dubbo/common/serialize/ObjectInput.readThrowable()Ljava/lang/Throwable;

JVM

org/apache/dubbo/rpc/protocol/dubbo/DecodeableRpcResult.handleException(Lorg/apache/dubbo/common/serialize/ObjectInput;)V

JVMVulnerable params: 0

Affected Ecosystems

affected

Source

National Vulnerability Database

References

Apache · AnnouncementPROJECT