[SECURITY] [DLA 2078-1] libxmlrpc3-java security update

2020-01-3016:31:17

lists.debian.org

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.014 Low

EPSS

Percentile

86.2%

JSON

Package : libxmlrpc3-java
Version : 3.1.3-7+deb8u1
CVE ID : CVE-2019-17570
Debian Bug : 949089

An untrusted deserialization was found in the
org.apache.xmlrpc.parser.XmlRpcResponseParser:addResult method of Apache
XML-RPC (aka ws-xmlrpc) library. A malicious XML-RPC server could target
a XML-RPC client causing it to execute arbitrary code.

Clients that expect to get server-side exceptions need to set the
enabledForExceptions property to true in order to process serialized
exception messages again.

For Debian 8 "Jessie", this problem has been fixed in version
3.1.3-7+deb8u1.

We recommend that you upgrade your libxmlrpc3-java packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

OSVersionArchitecturePackageVersionFilename
Debian9alllibxmlrpc3-client-java< 3.1.3-8+deb9u1libxmlrpc3-client-java_3.1.3-8+deb9u1_all.deb
Debian8alllibxmlrpc3-client-java< 3.1.3-7+deb8u1libxmlrpc3-client-java_3.1.3-7+deb8u1_all.deb
Debian8alllibxmlrpc3-server-java< 3.1.3-7+deb8u1libxmlrpc3-server-java_3.1.3-7+deb8u1_all.deb
Debian8alllibxmlrpc3-java-doc< 3.1.3-7+deb8u1libxmlrpc3-java-doc_3.1.3-7+deb8u1_all.deb
Debian9alllibxmlrpc3-common-java< 3.1.3-8+deb9u1libxmlrpc3-common-java_3.1.3-8+deb9u1_all.deb
Debian8alllibxmlrpc3-java< 3.1.3-7+deb8u1libxmlrpc3-java_3.1.3-7+deb8u1_all.deb
Debian10alllibxmlrpc3-java-doc< 3.1.3-9+deb10u1libxmlrpc3-java-doc_3.1.3-9+deb10u1_all.deb
Debian10alllibxmlrpc3-server-java< 3.1.3-9+deb10u1libxmlrpc3-server-java_3.1.3-9+deb10u1_all.deb
Debian10alllibxmlrpc3-java< 3.1.3-9+deb10u1libxmlrpc3-java_3.1.3-9+deb10u1_all.deb
Debian9alllibxmlrpc3-java-doc< 3.1.3-8+deb9u1libxmlrpc3-java-doc_3.1.3-8+deb9u1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	9	all	libxmlrpc3-client-java	< 3.1.3-8+deb9u1	libxmlrpc3-client-java_3.1.3-8+deb9u1_all.deb
Debian	8	all	libxmlrpc3-client-java	< 3.1.3-7+deb8u1	libxmlrpc3-client-java_3.1.3-7+deb8u1_all.deb
Debian	8	all	libxmlrpc3-server-java	< 3.1.3-7+deb8u1	libxmlrpc3-server-java_3.1.3-7+deb8u1_all.deb
Debian	8	all	libxmlrpc3-java-doc	< 3.1.3-7+deb8u1	libxmlrpc3-java-doc_3.1.3-7+deb8u1_all.deb
Debian	9	all	libxmlrpc3-common-java	< 3.1.3-8+deb9u1	libxmlrpc3-common-java_3.1.3-8+deb9u1_all.deb
Debian	8	all	libxmlrpc3-java	< 3.1.3-7+deb8u1	libxmlrpc3-java_3.1.3-7+deb8u1_all.deb
Debian	10	all	libxmlrpc3-java-doc	< 3.1.3-9+deb10u1	libxmlrpc3-java-doc_3.1.3-9+deb10u1_all.deb
Debian	10	all	libxmlrpc3-server-java	< 3.1.3-9+deb10u1	libxmlrpc3-server-java_3.1.3-9+deb10u1_all.deb
Debian	10	all	libxmlrpc3-java	< 3.1.3-9+deb10u1	libxmlrpc3-java_3.1.3-9+deb10u1_all.deb
Debian	9	all	libxmlrpc3-java-doc	< 3.1.3-8+deb9u1	libxmlrpc3-java-doc_3.1.3-8+deb9u1_all.deb