CVE-2019-17564

Name of the Vulnerable Software and Affected Versions Apache Dubbo versions 2.5.x Apache Dubbo versions 2.6.0 through 2.6.7 Apache Dubbo versions 2.7.0 through 2.7.4

Description Unsafe deserialization occurs within a Dubbo application which has HTTP remoting enabled. An attacker may submit a POST request with a Java object in it to completely compromise a Provider instance of Apache Dubbo, if this instance enables HTTP.

Recommendations For Apache Dubbo versions 2.5.x, consider disabling HTTP remoting to prevent exploitation until a patch is available. For Apache Dubbo versions 2.6.0 through 2.6.7, consider disabling HTTP remoting to prevent exploitation until a patch is available. For Apache Dubbo versions 2.7.0 through 2.7.4, consider disabling HTTP remoting to prevent exploitation until a patch is available. As a temporary workaround, consider restricting access to the HTTP endpoint to minimize the risk of exploitation.