CVE-2020-11995: Deserialization exploitation in Apache Dubbo
Summary
CVE-2020-11995: Deserialization exploitation in Apache Dubbo. Affects org.apache.dubbo:dubbo-parent across 2 version ranges.
< 2.6.9
>= 2.7.0, < 2.7.8
Fixed in 2.6.9 or 2.7.8, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Dubbo is an open-source, high-performance, and lightweight Java RPC framework. It provides a distributed architecture for building scalable and efficient applications. The vulnerability identified as CVE-2020-11995 affects versions 2.7.5 and earlier of the dubbo-parent package. Dubbo uses Hessian2 as its default serialization/deserialization protocol. During the deserialization process of a HashMap object, certain functions in the classes stored in the HashMap can be executed. This vulnerability allows an attacker to exploit these functions and execute malicious code remotely. The issue was fixed in Apache Dubbo versions 2.6.9 and 2.7.8.
Vulnerability Detail
The deserialization vulnerability in Apache Dubbo allows an attacker to execute arbitrary code remotely. By constructing a malicious request and exploiting the hashCode() function of the EqualsBean class in the rome-1.7.0.jar library, an attacker can load and execute malicious classes on the target system. This can lead to various malicious activities, including remote command execution. The vulnerability has a CVSS score of 9.8, indicating its critical severity.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.6.92.6.9 -
>= 2.7.0, < 2.7.82.7.8
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to the fixed versions of Apache Dubbo.
Conclusion
The deserialization vulnerability in Apache Dubbo (CVE-2020-11995) poses a significant risk as it allows remote code execution. It is crucial to upgrade to the fixed versions (2.6.9 or 2.7.8) to mitigate this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.apache.dubbo:dubbo-parent →
FAQ
Apache Dubbo is a Java RPC framework that provides a distributed architecture for building scalable and efficient applications.
The vulnerability allows an attacker to execute arbitrary code remotely, potentially leading to various malicious activities, including remote command execution.
Versions 2.7.5 and earlier of the dubbo-parent package are affected by this vulnerability.
To fix this vulnerability, upgrade to Apache Dubbo version 2.7.8 if you are using a version between 2.7.0 and 2.7.5. If you are using a version prior to 2.6.9, upgrade to Apache Dubbo version 2.6.9.
There is no known workaround for this vulnerability. It is crucial to apply the recommended fix by upgrading to the fixed versions of Apache Dubbo.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.dubbo:dubbo-parent.
