{"id":"GHSA-74mg-6xqx-2vrq","summary":"Deserialization exploitation in Apache Dubbo","details":"A deserialization vulnerability existed in dubbo 2.7.5 and its earlier versions, which could lead to malicious code execution. Most Dubbo users use Hessian2 as the default serialization/deserialization protool, during Hessian2 deserializing the HashMap object, some functions in the classes stored in HashMap will be executed after a series of program calls, however, those special functions may cause remote command execution. For example, the hashCode() function of the EqualsBean class in rome-1.7.0.jar will cause the remotely load malicious classes and execute malicious code by constructing a malicious request. This issue was fixed in Apache Dubbo 2.6.9 and 2.7.8.","aliases":["CVE-2020-11995"],"modified":"2023-11-08T04:02:09.098190Z","published":"2022-02-09T22:27:01Z","database_specific":{"cwe_ids":["CWE-502"],"severity":"CRITICAL","github_reviewed":true,"github_reviewed_at":"2021-04-06T22:54:20Z","nvd_published_at":"2021-01-11T10:15:00Z"},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-11995"},{"type":"WEB","url":"https://github.com/apache/dubbo/commit/d2e9baf380108950c48e0ab700ccdbf11dd753ab"},{"type":"WEB","url":"https://lists.apache.org/thread.html/r5b2df4ef479209dc4ced457b3d58a887763b60b9354c3dc148b2eb5b%40%3Cdev.dubbo.apache.org%3E"}],"affected":[{"package":{"name":"org.apache.dubbo:dubbo-parent","ecosystem":"Maven","purl":"pkg:maven/org.apache.dubbo/dubbo-parent"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.0"},{"fixed":"2.7.8"}]}],"versions":["2.7.0","2.7.1","2.7.2","2.7.3","2.7.4","2.7.4.1","2.7.5","2.7.6","2.7.7"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/02/GHSA-74mg-6xqx-2vrq/GHSA-74mg-6xqx-2vrq.json"}},{"package":{"name":"org.apache.dubbo:dubbo-parent","ecosystem":"Maven","purl":"pkg:maven/org.apache.dubbo/dubbo-parent"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.9"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/02/GHSA-74mg-6xqx-2vrq/GHSA-74mg-6xqx-2vrq.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}