CVE-2021-30179: Deserialization of Untrusted Data

March 18, 2022 (updated March 21, 2022)

Apache Dubbo prior to 2.6.9 and 2.7.9 by default supports generic calls to arbitrary methods exposed by provider interfaces. These invocations are handled by the GenericFilter which will find the service and method specified in the first arguments of the invocation and use the Java Reflection API to make the final call.

References

github.com/advisories/GHSA-5mc7-m686-p6jg
nvd.nist.gov/vuln/detail/CVE-2021-30179

Detect and mitigate CVE-2021-30179 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →