Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2021:1995-1

Опубликовано: 17 июн. 2021
Источник: suse-cvrf

Описание

Security update for xstream

This update for xstream fixes the following issues:

Upgrade to 1.4.17

  • CVE-2021-29505: Fixed potential code execution when unmarshalling with XStream instances using an uninitialized security framework (bsc#1186651)

Список пакетов

Container suse/manager/5.0/x86_64/server:latest
xstream-1.4.17-3.11.2
Container suse/multi-linux-manager/5.1/x86_64/server:latest
xstream-1.4.17-3.11.2
Image SLES15-SP3-Manager-4-2-Server-BYOS-Azure
xstream-1.4.17-3.11.2
Image SLES15-SP3-Manager-4-2-Server-BYOS-EC2-HVM
xstream-1.4.17-3.11.2
Image SLES15-SP3-Manager-4-2-Server-BYOS-GCE
xstream-1.4.17-3.11.2
Image SLES15-SP4-Manager-Server-4-3
xstream-1.4.17-3.11.2
Image SLES15-SP4-Manager-Server-4-3-Azure-llc
xstream-1.4.17-3.11.2
Image SLES15-SP4-Manager-Server-4-3-Azure-ltd
xstream-1.4.17-3.11.2
Image SLES15-SP4-Manager-Server-4-3-BYOS
xstream-1.4.17-3.11.2
Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure
xstream-1.4.17-3.11.2
Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2
xstream-1.4.17-3.11.2
Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE
xstream-1.4.17-3.11.2
Image SLES15-SP4-Manager-Server-4-3-EC2-llc
xstream-1.4.17-3.11.2
Image SLES15-SP4-Manager-Server-4-3-EC2-ltd
xstream-1.4.17-3.11.2
SUSE Linux Enterprise Module for Development Tools 15 SP2
xstream-1.4.17-3.11.2
SUSE Linux Enterprise Module for Development Tools 15 SP3
xstream-1.4.17-3.11.2
SUSE Manager Server Module 4.1
xstream-1.4.17-3.11.2
SUSE Manager Server Module 4.2
xstream-1.4.17-3.11.2

Ссылки

Описание

XStream is software for serializing Java objects to XML and back again. A vulnerability in XStream versions prior to 1.4.17 may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types is affected. The vulnerability is patched in version 1.4.17.

Затронутые продукты
Container suse/manager/5.0/x86_64/server:latest:xstream-1.4.17-3.11.2
Container suse/multi-linux-manager/5.1/x86_64/server:latest:xstream-1.4.17-3.11.2
Image SLES15-SP3-Manager-4-2-Server-BYOS-Azure:xstream-1.4.17-3.11.2
Image SLES15-SP3-Manager-4-2-Server-BYOS-EC2-HVM:xstream-1.4.17-3.11.2
Ссылки
Уязвимость SUSE-SU-2021:1995-1