Important: Red Hat Security Advisory: Red Hat JBoss Fuse/A-MQ 6.3 R18 security and bug fix update

An update is now available for Red Hat JBoss Fuse 6.3 and Red Hat JBoss A-MQ 6.3. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Ubuntu 18.04 LTS / 20.04 LTS : XStream vulnerabilities (USN-4714-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4714-1 advisory. Zhihong Tian and Hui Lu found that XStream was vulnerable to remote code execution. A remote attacker could run arbitrary shell commands by...

USN-4714-1 libxstream-java vulnerabilities

Zhihong Tian and Hui Lu found that XStream was vulnerable to remote code execution. A remote attacker could run arbitrary shell commands by manipulating the processed input stream. CVE-2020-26217 It was discovered that XStream was vulnerable to server-side forgery attacks. A remote attacker could...

USN-4714-1: XStream vulnerabilities

Zhihong Tian and Hui Lu found that XStream was vulnerable to remote code execution. A remote attacker could run arbitrary shell commands by manipulating the processed input stream. CVE-2020-26217 It was discovered that XStream was vulnerable to server-side forgery attacks. A remote attacker could...

CentOS: Security Advisory for xstream (CESA-2021:0162)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Important: xstream

Issue Overview: A flaw was found in xstream. An unsafe deserialization of user-supplied XML, in conjunction with relying on the default deny list, allows a remote attacker to perform a variety of attacks including a remote code execution of arbitrary code in the context of the JVM running the...

Scientific Linux Security Update : xstream on SL7.x (noarch) (2021:0162)

The remote Scientific Linux 7 host has packages installed that are affected by a vulnerability as referenced in the SLSA-2021:0162-1 advisory. - XStream: remote code execution due to insecure XML deserialization when relying on blocklists CVE-2020-26217 Note that Nessus has not tested for this...

CentOS 7 : xstream (RHSA-2021:0162)

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:0162 advisory. - XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by...

Amazon Linux 2 : xstream (ALAS-2021-1593)

The version of xstream installed on the remote host is prior to 1.3.1-12. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1593 advisory. A flaw was found in xstream. An unsafe deserialization of user-supplied XML, in conjunction with relying on the default deny list,...

xstream security update

CentOS Errata and Security Advisory CESA-2021:0162 An update for xstream is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

openSUSE Security Update : xstream (openSUSE-2021-140)

This update for xstream fixes the following issues : xstream was updated to version 1.4.15. - CVE-2020-26217: Fixed a remote code execution due to insecure XML deserialization when relying on blocklists bsc1180994. - CVE-2020-26258: Fixed a server-side request forgery vulnerability bsc1180146. -...

Exploit for OS Command Injection in Apache Struts

CVE-2020-26259 CVE-2020-26259: XStream1.4.14 is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling as long as the executing process has sufficient rights. https://x-stream.github.io/CVE-2020-26259.html XStream 1.4.14 pom.xml com.thoughtworks.xstream xstream 1.4.14 poc...

Exploit for OS Command Injection in Xstream

CVE-2020-26217 is a remote code execution RCE vulnerability in the XStream library, which is a popular XML serialization library for Java. The vulnerability is present in versions of XStream prior to 1.4.13. The vulnerability is caused by a deserialization issue in the XStream library, which allo...

OPENSUSE-SU-2021:0140-1 Security update for xstream

This update for xstream fixes the following issues: xstream was updated to version 1.4.15. - CVE-2020-26217: Fixed a remote code execution due to insecure XML deserialization when relying on blocklists bsc1180994. - CVE-2020-26258: Fixed a server-side request forgery vulnerability bsc1180146. -...

Exploit for OS Command Injection in Xstream

Description XStream can be used for Remote Code Execution...

Exploit for OS Command Injection in Apache Struts

Description XStream is vulnerable to an Arbitrary File Delet...

Exploit for Server-Side Request Forgery in Apache Struts

Description XStream is a Java library to serialize objects t...

Security update for xstream (important)

openSUSE Security Update: Security update for xstream Announcement ID: openSUSE-SU-2021:0140-1 Rating: important References: 1180145 1180146 1180994 Cross-References: CVE-2020-26217 CVE-2020-26258 CVE-2020-26259 Affected Products: openSUSE Leap 15.2 An update that fixes three vulnerabilities is n...

SUSE-SU-2021:0176-1 Security update for xstream

This update for xstream fixes the following issues: xstream was updated to version 1.4.15. - CVE-2020-26217: Fixed a remote code execution due to insecure XML deserialization when relying on blocklists bsc1180994. - CVE-2020-26258: Fixed a server-side request forgery vulnerability bsc1180146. -...

Oracle Linux 7 : xstream (ELSA-2021-0162)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2021-0162 advisory. 1.3.1-12 - Rebuild with OpenJDK 7 1.3.1-11 - Fix remote code execution vulnerability - Resolves: CVE-2020-26217 Tenable has extracted the preceding description...