Описание
Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. e.g. JSON.
It was found that XStream could deserialize arbitrary user-supplied XML content, representing objects of any type. A remote attacker able to pass XML to XStream could use this flaw to perform a variety of attacks, including remote code execution in the context of the server running the XStream application.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| OpenShift Enterprise 1 | xstream | Will not fix | ||
| Red Hat Enterprise Linux 7 | xstream | Not affected | ||
| Red Hat JBoss SOA Platform 4 | xstream | Will not fix | ||
| Red Hat OpenShift Enterprise 2 | xstream | Affected | ||
| Fuse ESB Enterprise 7.1.0 | Fixed | RHSA-2014:0452 | 30.04.2014 | |
| Fuse Management Console 7.1.0 | Fixed | RHSA-2014:0452 | 30.04.2014 | |
| Fuse MQ Enterprise 7.1.0 | Fixed | RHSA-2014:0452 | 30.04.2014 | |
| JBoss Enterprise BRMS Platform 5.3 | xstream | Fixed | RHSA-2014:1007 | 05.08.2014 |
| Red Hat JBoss A-MQ 6.0 | Fixed | RHSA-2014:0323 | 24.03.2014 | |
| Red Hat JBoss BPMS 6.0 | xstream | Fixed | RHSA-2014:0371 | 03.04.2014 |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
EPSS
6.8 Medium
CVSS2
Связанные уязвимости
Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. e.g. JSON.
Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. e.g. JSON.
Xstream API versions up to 1.4.6 and version 1.4.10, if the security f ...
ALT-PU-2016-3325: package `xstream` update to version 1.4.8-alt0.1jpp
EPSS
6.8 Medium
CVSS2