CVE-2021-37579: Bypass deserialization checks in Apache Dubbo
The Dubbo Provider will check the incoming request and the corresponding serialization type of this request meet the configuration set by the server. But there's an exception that the attacker can use to skip the security check (when enabled) and reaching a deserialization operation with native java serialization. Apache Dubbo 2.7.13, 3.0.2 fixed this issue by quickly fail when any unrecognized request was found.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-37579?
CVE-2021-37579 is a vulnerability that allows an attacker to bypass security checks in the Apache Dubbo Provider and perform a deserialization operation with native java.
What is the severity of CVE-2021-37579?
The severity of CVE-2021-37579 is critical with a CVSS score of 9.8.
Which software versions are affected by CVE-2021-37579?
CVE-2021-37579 affects Apache Dubbo versions between 2.7.0 and 2.7.13, as well as versions between 3.0.0 and 3.0.2.
How can an attacker exploit CVE-2021-37579?
An attacker can exploit CVE-2021-37579 by using an exception to bypass security checks in the Apache Dubbo Provider and perform a deserialization operation with native java.
Is there a fix for CVE-2021-37579?
At the moment, there is no official fix for CVE-2021-37579. It is recommended to update to a fixed version once it becomes available.