Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache Dubbo default deserialization protocol Hessian2 cause CRE
Vulnerability Description
A deserialization vulnerability existed in dubbo 2.7.5 and its earlier versions, which could lead to malicious code execution. Most Dubbo users use Hessian2 as the default serialization/deserialization protool, during Hessian2 deserializing the HashMap object, some functions in the classes stored in HasMap will be executed after a series of program calls, however, those special functions may cause remote command execution. For example, the hashCode() function of the EqualsBean class in rome-1.7.0.jar will cause the remotely load malicious classes and execute malicious code by constructing a malicious request. This issue was fixed in Apache Dubbo 2.6.9 and 2.7.8.
CVSS Information
N/A
Vulnerability Type
可信数据的反序列化
Vulnerability Title
Apache Dubbo 代码问题漏洞
Vulnerability Description
Apache Dubbo是美国阿帕奇软件（Apache）基金会的一款基于Java的轻量级RPC（远程过程调用）框架。该产品提供了基于接口的远程呼叫、容错和负载平衡以及自动服务注册和发现等功能。 Apache Dubbo 版本代码 2.7.5 及之前版本中存在代码问题漏洞。该漏洞源于使用者使用Hessian2作为序列化和反序列化的工具，该工具反序列化HashMap对象的时候，同时会执行一些代码从而引起代码执行。
CVSS Information
N/A
Vulnerability Type
N/A