Deserialization in Apache Dubbo
CVE-2021-43297
A deserialization vulnerability existed in dubbo hessian-lite 3.2.11 and its earlier versions, which could lead to malicious code execution. Most Dubbo users use Hessian2 as the default serialization/deserialization protocol, during Hessian catch unexpected exceptions, Hessian will log out some imformation for users, which may cause remote command execution. This issue affects Apache Dubbo Apache Dubbo 2.6.x versions prior to 2.6.12; Apache Dubbo 2.7.x versions prior to 2.7.15; Apache Dubbo 3.0.x versions prior to 3.0.5.
Vulnerability class: Insecure Deserialization
EPSS: 0.153 (96.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Apache Dubbo
- Apache Software Foundation Dubbo — versions Apache Dubbo 2.6.x, Apache Dubbo 2.7.x, Apache Dubbo 3.0.x
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security@apache.org (Mailing List, x_refsource_MISC, Vendor Advisory)
Frequently asked questions
- What is CVE-2021-43297?
- CVE-2021-43297 is a critical-severity vulnerability in Apache Dubbo, classified under Deserialization of Untrusted Data. CVSS score: 9.8/10. Published 2022-01-10.
- How severe is CVE-2021-43297?
- Critical severity. CVSS v3 base score is 9.8 out of 10.
- Is CVE-2021-43297 known to be exploited?
- 22 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.