Severity: Medium Vendor: The Dubbo Project Team
Versions Affected: Dubbo 2.7.0 to 2.7.7 Dubbo 2.6.0 to 2.6.8 Dubbo all 2.5.x versions (not supported by official team any longer) Description: This vulnerability can affect all Dubbo users using 2.5.x, 2.6.x and 2.7.x, please upgrade to 2.6.9 or 2.7.8 to solve this issue. Check here for how we fix it by supporting whitelist in Hessian2 3.2.9: https://github.com/apache/dubbo/releases/tag/dubbo-2.7.8 https://github.com/apache/dubbo-hessian-lite/releases/tag/v3.2.9 A deserialization vulnerability exists in dubbo 2.7.5 and its earlier versions, which could lead to malicious code execution. Most Dubbo users use Hessian2 as the default serialization/deserialization protool, during Hessian2 deserializing the HashMap object, some functions in the classes stored in HasMap will be executed after a series of program calls, however, those special functions may cause remote command execution. For example, the hashCode() function of the EqualsBean class in rome-1.7.0.jar will cause the remotely load malicious classes and execute malicious code by constructing a malicious request. Jun
