CVE-2023-46279: Apache Dubbo: Bypass deny serialize list check in Apache Dubbo
Published Dec 15, 2023
·Updated
Deserialization of Untrusted Data vulnerability in Apache Dubbo.This issue only affects Apache Dubbo 3.1.5.
Users are recommended to upgrade to the latest version, which fixes the issue.
Affected Software
2 affected componentsFixes available
Apache Dubbo=3.1.5
maven/org.apache.dubbo:dubbo=3.1.5
3.1.6
Event History
Dec 15, 2023
CVE Published
via MITRE·08:15 AM
Data Sourced
via MITRE·08:15 AM
DescriptionWeakness
Data Sourced
via NVD·09:15 AM
DescriptionSeverityWeaknessAffected Software
Advisory Published
09:30 AM
Frequently Asked Questions
1
What is the severity of CVE-2023-46279?
CVE-2023-46279 is a serious vulnerability that can lead to remote code execution due to deserialization of untrusted data.
2
How do I fix CVE-2023-46279?
To fix CVE-2023-46279, you should upgrade your Apache Dubbo version from 3.1.5 to 3.1.6 or later.
3
Which versions of Apache Dubbo are affected by CVE-2023-46279?
Only Apache Dubbo version 3.1.5 is affected by CVE-2023-46279.
4
What kind of vulnerability is CVE-2023-46279?
CVE-2023-46279 is a deserialization of untrusted data vulnerability.
5
Is there a patch available for CVE-2023-46279?
Yes, a patch is available in Apache Dubbo version 3.1.6 which resolves CVE-2023-46279.