Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

openSUSE-SU-2021:0911-1

Опубликовано: 24 июн. 2021
Источник: suse-cvrf

Описание

Security update for xstream

This update for xstream fixes the following issues:

Upgrade to 1.4.17

  • CVE-2021-29505: Fixed potential code execution when unmarshalling with XStream instances using an uninitialized security framework (bsc#1186651)

This update was imported from the SUSE:SLE-15-SP2:Update update project.

Список пакетов

openSUSE Leap 15.2
xstream-1.4.17-lp152.2.9.1
xstream-benchmark-1.4.17-lp152.2.9.1
xstream-javadoc-1.4.17-lp152.2.9.1
xstream-parent-1.4.17-lp152.2.9.1

Ссылки

Описание

XStream is software for serializing Java objects to XML and back again. A vulnerability in XStream versions prior to 1.4.17 may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types is affected. The vulnerability is patched in version 1.4.17.

Затронутые продукты
openSUSE Leap 15.2:xstream-1.4.17-lp152.2.9.1
openSUSE Leap 15.2:xstream-benchmark-1.4.17-lp152.2.9.1
openSUSE Leap 15.2:xstream-javadoc-1.4.17-lp152.2.9.1
openSUSE Leap 15.2:xstream-parent-1.4.17-lp152.2.9.1
Ссылки