Описание
XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream. Only users who rely on blocklists are affected. Anyone using XStream's Security Framework allowlist is not affected. The linked advisory provides code workarounds for users who cannot upgrade. The issue is fixed in version 1.4.14.
A flaw was found in xstream. An unsafe deserialization of user-supplied XML, in conjunction with relying on the default deny list, allows a remote attacker to perform a variety of attacks including a remote code execution of arbitrary code in the context of the JVM running the XStream application. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Отчет
OpenShift Container Platform (OCP) delivers jenkins package with bundled XStream library. Due to JEP-200 Jenkins project [1] and advisory SECURITY-383 [2], OCP jenkins package is not affected by this flaw. [1] https://github.com/jenkinsci/jep/blob/master/jep/200/README.adoc [2] https://www.jenkins.io/security/advisory/2017-02-01/ (see SECURITY-383 / CVE-2017-2608)
Меры по смягчению последствий
Depending on the version of XStream used there are various usage patterns that mitigate this flaw, though we would strongly recommend using the allow list approach if at all possible as there are likely more class combinations the deny list approach may not address. Allow list approach
Deny list for XStream 1.4.13
Deny list for XStream 1.4.7 -> 1.4.12
Deny list for versions prior to XStream 1.4.7
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat BPM Suite 6 | xstream | Out of support scope | ||
| Red Hat CodeReady Studio 12 | xstream | Affected | ||
| Red Hat Integration Camel K 1 | xstream | Affected | ||
| Red Hat JBoss BRMS 6 | xstream | Out of support scope | ||
| Red Hat JBoss Data Grid 7 | xstream | Out of support scope | ||
| Red Hat JBoss Fuse Service Works 6 | xstream | Out of support scope | ||
| Red Hat OpenShift Container Platform 3.11 | jenkins | Not affected | ||
| Red Hat OpenShift Container Platform 4 | jenkins | Not affected | ||
| Red Hat Data Grid 8.1.1 | xstream | Fixed | RHSA-2021:0433 | 08.02.2021 |
| Red Hat Enterprise Linux 7 | xstream | Fixed | RHSA-2021:0162 | 18.01.2021 |
Показывать по
Дополнительная информация
Статус:
EPSS
9 Critical
CVSS3
Связанные уязвимости
XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream. Only users who rely on blocklists are affected. Anyone using XStream's Security Framework allowlist is not affected. The linked advisory provides code workarounds for users who cannot upgrade. The issue is fixed in version 1.4.14.
XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream. Only users who rely on blocklists are affected. Anyone using XStream's Security Framework allowlist is not affected. The linked advisory provides code workarounds for users who cannot upgrade. The issue is fixed in version 1.4.14.
XStream before version 1.4.14 is vulnerable to Remote Code Execution.T ...
EPSS
9 Critical
CVSS3