Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

openSUSE-SU-2021:1995-1

Опубликовано: 11 июл. 2021
Источник: suse-cvrf

Описание

Security update for xstream

This update for xstream fixes the following issues:

Upgrade to 1.4.17

  • CVE-2021-29505: Fixed potential code execution when unmarshalling with XStream instances using an uninitialized security framework (bsc#1186651)

Список пакетов

openSUSE Leap 15.3
xstream-1.4.17-3.11.2
xstream-benchmark-1.4.17-3.11.2
xstream-javadoc-1.4.17-3.11.2
xstream-parent-1.4.17-3.11.2

Ссылки

Описание

XStream is software for serializing Java objects to XML and back again. A vulnerability in XStream versions prior to 1.4.17 may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types is affected. The vulnerability is patched in version 1.4.17.

Затронутые продукты
openSUSE Leap 15.3:xstream-1.4.17-3.11.2
openSUSE Leap 15.3:xstream-benchmark-1.4.17-3.11.2
openSUSE Leap 15.3:xstream-javadoc-1.4.17-3.11.2
openSUSE Leap 15.3:xstream-parent-1.4.17-3.11.2
Ссылки