| { |
| "containers": { |
| "cna": { |
| "affected": [ |
| { |
| "product": "Apache Dubbo", |
| "vendor": "Apache Software Foundation", |
| "versions": [ |
| { |
| "changes": [ |
| { |
| "at": "2.7.8", |
| "status": "unaffected" |
| } |
| ], |
| "lessThan": "2.6.9", |
| "status": "affected", |
| "version": "Apache Dubbo", |
| "versionType": "custom" |
| } |
| ] |
| } |
| ], |
| "descriptions": [ |
| { |
| "lang": "en", |
| "value": "A deserialization vulnerability existed in dubbo 2.7.5 and its earlier versions, which could lead to malicious code execution. Most Dubbo users use Hessian2 as the default serialization/deserialization protool, during Hessian2 deserializing the HashMap object, some functions in the classes stored in HasMap will be executed after a series of program calls, however, those special functions may cause remote command execution. For example, the hashCode() function of the EqualsBean class in rome-1.7.0.jar will cause the remotely load malicious classes and execute malicious code by constructing a malicious request. This issue was fixed in Apache Dubbo 2.6.9 and 2.7.8." |
| } |
| ], |
| "problemTypes": [ |
| { |
| "descriptions": [ |
| { |
| "cweId": "CWE-502", |
| "description": "CWE-502 Deserialization of Untrusted Data", |
| "lang": "en", |
| "type": "CWE" |
| } |
| ] |
| } |
| ], |
| "providerMetadata": { |
| "orgId": "Not found", |
| "shortName": "Not found" |
| }, |
| "references": [ |
| { |
| "tags": [ |
| "x_refsource_CONFIRM" |
| ], |
| "url": "https://lists.apache.org/thread.html/r5b2df4ef479209dc4ced457b3d58a887763b60b9354c3dc148b2eb5b%40%3Cdev.dubbo.apache.org%3E" |
| } |
| ], |
| "source": { |
| "discovery": "UNKNOWN" |
| }, |
| "title": "Apache Dubbo default deserialization protocol Hessian2 cause CRE", |
| "x_ValidationErrors": [ |
| "$.cveMetadata.assignerOrgId -- validator = pattern", |
| "$.containers.cna.providerMetadata.orgId -- validator = pattern" |
| ], |
| "x_generator": { |
| "engine": "Vulnogram 0.0.9" |
| }, |
| "x_legacyV4Record": { |
| "CNA_private": { |
| "CVE_list": [], |
| "CVE_table_description": [], |
| "email": "mjc@apache.org", |
| "internal_comments": "", |
| "owner": "dubbo", |
| "publish": { |
| "month": "", |
| "year": "", |
| "ym": "" |
| }, |
| "share_with_CVE": true, |
| "todo": [] |
| }, |
| "CVE_data_meta": { |
| "AKA": "", |
| "ASSIGNER": "security@apache.org", |
| "DATE_PUBLIC": "", |
| "ID": "CVE-2020-11995", |
| "STATE": "PUBLIC", |
| "TITLE": "Apache Dubbo default deserialization protocol Hessian2 cause CRE" |
| }, |
| "affects": { |
| "vendor": { |
| "vendor_data": [ |
| { |
| "product": { |
| "product_data": [ |
| { |
| "product_name": "Apache Dubbo", |
| "version": { |
| "version_data": [ |
| { |
| "platform": "", |
| "version_affected": "<", |
| "version_name": "Apache Dubbo", |
| "version_value": "2.6.9" |
| }, |
| { |
| "platform": "", |
| "version_affected": "<", |
| "version_name": "Apache Dubbo", |
| "version_value": "2.7.8" |
| } |
| ] |
| } |
| } |
| ] |
| }, |
| "vendor_name": "Apache Software Foundation" |
| } |
| ] |
| } |
| }, |
| "configuration": [], |
| "credit": [], |
| "data_format": "MITRE", |
| "data_type": "CVE", |
| "data_version": "4.0", |
| "description": { |
| "description_data": [ |
| { |
| "lang": "eng", |
| "value": "A deserialization vulnerability existed in dubbo 2.7.5 and its earlier versions, which could lead to malicious code execution. Most Dubbo users use Hessian2 as the default serialization/deserialization protool, during Hessian2 deserializing the HashMap object, some functions in the classes stored in HasMap will be executed after a series of program calls, however, those special functions may cause remote command execution. For example, the hashCode() function of the EqualsBean class in rome-1.7.0.jar will cause the remotely load malicious classes and execute malicious code by constructing a malicious request. This issue was fixed in Apache Dubbo 2.6.9 and 2.7.8." |
| } |
| ] |
| }, |
| "exploit": [], |
| "generator": { |
| "engine": "Vulnogram 0.0.9" |
| }, |
| "impact": {}, |
| "problemtype": { |
| "problemtype_data": [ |
| { |
| "description": [ |
| { |
| "lang": "eng", |
| "value": "CWE-502 Deserialization of Untrusted Data" |
| } |
| ] |
| } |
| ] |
| }, |
| "references": { |
| "reference_data": [ |
| { |
| "name": "", |
| "refsource": "CONFIRM", |
| "url": "https://lists.apache.org/thread.html/r5b2df4ef479209dc4ced457b3d58a887763b60b9354c3dc148b2eb5b%40%3Cdev.dubbo.apache.org%3E" |
| } |
| ] |
| }, |
| "solution": [], |
| "source": { |
| "advisory": "", |
| "defect": [], |
| "discovery": "UNKNOWN" |
| }, |
| "work_around": [] |
| } |
| } |
| }, |
| "cveMetadata": { |
| "assignerOrgId": "Not found", |
| "assignerShortName": "Not found", |
| "cveId": "CVE-2020-11995", |
| "state": "PUBLISHED" |
| }, |
| "dataType": "CVE_RECORD", |
| "dataVersion": "5.0" |
| } |
