critical9.8
CVE-2021-30180
Code injection in Apache Dubbo
Impact
Apache Dubbo prior to 2.7.9 support Tag routing which will enable a customer to route the request to the right server. These rules are used by the customers when making a request in order to find the right endpoint. When parsing these YAML rules, Dubbo customers may enable calling arbitrary constructors.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.apache.dubbo:dubbo | >= 2.7.0, < 2.7.10 | 2.7.10 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Apache | Dubbo | from 2.7.0 before 2.7.10 |