CVE-2021-36162

Name of the Vulnerable Software and Affected Versions Apache Dubbo versions prior to 2.7.13 Apache Dubbo versions prior to 3.0.2

Description The issue arises from the use of the SnakeYAML library to parse YAML rules in Apache Dubbo, which by default enables the calling of arbitrary constructors. An attacker with access to the configuration center can poison the rules, leading to remote code execution (RCE) on all consumer systems that retrieve the tainted rules.

Recommendations For Apache Dubbo versions prior to 2.7.13, update to version 2.7.13 or later. For Apache Dubbo versions prior to 3.0.2, update to version 3.0.2 or later.