Description
Deserialization of Untrusted Data vulnerability in Apache Dubbo.This issue only affects Apache Dubbo 3.1.5. Users are recommended to upgrade to the latest version, which fixes the issue.
Remediation
References
http://www.openwall.com/lists/oss-security/2023/12/15/3
https://lists.apache.org/thread/zw53nxrkrfswmk9n3sfwxmcj7x030nmo
Related Vulnerabilities
CVE-2022-39135 Vulnerability in maven package org.apache.calcite:calcite-core
CVE-2022-34917 Vulnerability in maven package org.apache.kafka:kafka-clients
CVE-2020-17510 Vulnerability in maven package org.apache.shiro:shiro-spring-boot-web-starter
CVE-2013-4317 Vulnerability in maven package org.apache.cloudstack:cloudstack
CVE-2015-8860 Vulnerability in maven package org.webjars.npm:tar