PT-2021-21150
CVE-2021-36162
·
تاريخ النشر
2021-09-07
·
تاريخ التحديث
2021-09-14
الوصف من
CVSS 3.1
8.8
عاليةالمقاييسAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
Apache Dubbo versions prior to 2.7.13
Apache Dubbo versions prior to 3.0.2
Description
The issue arises from the use of the SnakeYAML library to parse YAML rules in Apache Dubbo, which by default enables the calling of arbitrary constructors. An attacker with access to the configuration center can poison the rules, leading to remote code execution (RCE) on all consumer systems that retrieve the tainted rules.
Recommendations
For Apache Dubbo versions prior to 2.7.13, update to version 2.7.13 or later.
For Apache Dubbo versions prior to 3.0.2, update to version 3.0.2 or later.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾