CVE-2021-36161: Use of Externally-Controlled Format String

September 9, 2021 (updated September 17, 2021)

A component in Dubbo will try to print the formated string of the input arguments, which will possibly cause RCE for a maliciously customized bean with special toString method.

References

nvd.nist.gov/vuln/detail/CVE-2021-36161

Code Behaviors & Features

Detect and mitigate CVE-2021-36161 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →