Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2021-30180

Apache Dubbo RCE on customers via Condition route poisoning (Unsafe YAML unmarshaling)

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
apache

Description

Apache Dubbo prior to 2.7.9 support Tag routing which will enable a customer to route the request to the right server. These rules are used by the customers when making a request in order to find the right endpoint. When parsing these YAML rules, Dubbo customers may enable calling arbitrary constructors.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Apache Software Foundation Apache Dubbo

  • Apache Dubbo 2.7.x to < 2.7.9affected

References