GHSL-2021-034: _043: Multiple pre-auth RCEs in Apache Dubbo - CVE-2021-25641, CVE-2021-30179, CVE-2021-30180, CVE-2021-30181, CVE-2021-32824
Published Jun 22, 2021
·Updated
Multiple vulnerabilities have been found in Apache Dubbo enabling attackers to compromise and run arbitrary system commands on both Dubbo consumers and providers.
Affected Software
1 affected component
Apache Dubbo
Event History
Jun 22, 2021
Advisory Published
via GitHub Security Lab·12:00 AM
Data Sourced
via GitHub Security Lab·12:00 AM
Description
Frequently Asked Questions
1
What is the severity of GHSL-2021-034?
The severity of GHSL-2021-034 is rated at 89, indicating a high risk level.
2
How do I fix GHSL-2021-034?
To fix GHSL-2021-034, update Apache Dubbo to the latest version that addresses these vulnerabilities.
3
What vulnerabilities are included in GHSL-2021-034?
GHSL-2021-034 includes vulnerabilities CVE-2021-25641, CVE-2021-30179, CVE-2021-30180, CVE-2021-30181, and CVE-2021-32824.
4
What impact does GHSL-2021-034 have on systems?
GHSL-2021-034 allows attackers to execute arbitrary system commands on both Dubbo consumers and providers.
5
Is Apache Dubbo safe to use after GHSL-2021-034?
Apache Dubbo can be safe to use if it is updated to the version that patches the vulnerabilities found in GHSL-2021-034.