{"id":"GHSA-69wp-3pm3-hxgg","summary":"Deserialization of Untrusted Data in Apache Dubbo","details":"Unsafe deserialization occurs within a Dubbo application which has HTTP remoting enabled. An attacker may submit a POST request with a Java object in it to completely compromise a Provider instance of Apache Dubbo, if this instance enables HTTP. This issue affected Apache Dubbo 2.7.0 to 2.7.4, 2.6.0 to 2.6.7, and all 2.5.x versions.","aliases":["CVE-2019-17564"],"modified":"2024-12-05T05:26:00.128857Z","published":"2022-05-24T17:13:14Z","database_specific":{"github_reviewed_at":"2022-11-04T22:36:16Z","nvd_published_at":"2020-04-01T22:15:00Z","cwe_ids":["CWE-502"],"severity":"MODERATE","github_reviewed":true},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-17564"},{"type":"WEB","url":"https://github.com/apache/dubbo/commit/9b18fe228971eaeca9b87d7b7e95df1c2a8ff91b"},{"type":"WEB","url":"https://advisory.checkmarx.net/advisory/CX-2020-4275"},{"type":"WEB","url":"https://github.com/apache/dubbo/releases/tag/dubbo-2.7.5"},{"type":"WEB","url":"https://lists.apache.org/thread.html/r13f7a58fa5d61d729e538a378687118e00c3e229903ba1e7b3a807a2%40%3Cdev.dubbo.apache.org%3E"}],"affected":[{"package":{"name":"org.apache.dubbo:dubbo-rpc-http-invoker","ecosystem":"Maven","purl":"pkg:maven/org.apache.dubbo/dubbo-rpc-http-invoker"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.0"},{"fixed":"2.7.5"}]}],"versions":["2.7.4","2.7.4.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-69wp-3pm3-hxgg/GHSA-69wp-3pm3-hxgg.json"}}],"schema_version":"1.9.0"}