CVE-2020-11995

CVE-2020-11995

maven/org.apache.dubbo/dubbo

Deserialization of Untrusted Data

A deserialization vulnerability existed in dubbo which could lead to malicious code execution. Most Dubbo users use Hessian2 as the default serialization/deserialization protool, during Hessian2 deserializing the HashMap object, some functions in the classes stored in HasMap will be executed after a series of program calls, however, those special functions may cause remote command execution. For example, the hashCode() function of the EqualsBean class in rome-1.7.0.jar will cause the remotely load malicious classes and execute malicious code by constructing a malicious request. This issue was fixed in Apache Dubbo

All versions starting from 2.5.0 up to 2.5.10, all versions starting from 2.6.0 up to 2.6.8, all versions starting from 2.7.0 up to 2.7.7

Upgrade to version 2.7.8 or above.

2021-01-16