CWE-502 Deserialization of Untrusted Data at the eventmesh-meta-raft plugin module in Apache EventMesh master branch without release version on windows\linux\mac os e.g. platforms allows attackers to send controlled message and remote code execute via hessian deserialization rpc protocol. Users can use the code under the master branch in project repo or version 1.11.0 to fix this issue.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| http://www.openwall.com/lists/oss-security/2025/02/14/7 | Mailing List Third Party Advisory |
| https://lists.apache.org/thread/k9fw0t5r7t1vbx53gs8d1r8c54rhx0wd | Mailing List Vendor Advisory Issue Tracking |
Configurations
History
14 Jul 2025, 13:07
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://lists.apache.org/thread/k9fw0t5r7t1vbx53gs8d1r8c54rhx0wd - Mailing List, Vendor Advisory, Issue Tracking | |
| References | () http://www.openwall.com/lists/oss-security/2025/02/14/7 - Mailing List, Third Party Advisory | |
| CPE | cpe:2.3:a:apache:eventmesh:*:*:*:*:*:*:*:* | |
| First Time |
Apache eventmesh
Apache |
14 Feb 2025, 17:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
|
| CWE |
14 Feb 2025, 14:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-02-14 14:15
Updated : 2025-07-14 13:07
NVD link : CVE-2024-56180
Mitre link : CVE-2024-56180
JSON object : View
Products Affected
apache
- eventmesh
CWE
No CWE.