Apache · Apache Dubbo
Unsafe deserialization occurs within a Dubbo application which has HTTP remoting enabled. An attacker may submit a POST request with a Java object in it to completely compromise a Provider instance of Apache Dubbo, if this instance enables HTTP. This issue affected Apache Dubbo 2.7.0 to 2.7.4, 2.6.0 to 2.6.7, and all 2.5.x versions.
First seen exploited 4 years after disclosure. Public exploit code (PoC-in-GitHub) was available 48 days before disclosure.
No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
1 package in 1 ecosystem. Main package: org.apache.dubbo:dubbo-rpc-http-invoker.
Upgrade to 2.7.5 or later
Set the version to 2.7.5 or later in your pom.xml or build.gradle.
The first fix for CVE-2019-17564. No other CVE tracked by Patchfirst affects this package.
| If you run | Upgrade to |
|---|---|
| 2.5.0 up to 2.7.5 | 2.7.5 |
“Up to” means the second version is the fix and is not affected.
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.