xstream:XmlFuzzer: Uncaught exception in com.ctc.wstx.dtd.FullDTDReader.readContentSpec

Detailed Report: https://oss-fuzz.com/testcase?key=5090175178375168 Project: xstream Fuzzing Engine: libFuzzer Fuzz Target: XmlFuzzer Job Type: libfuzzerasanxstream Platform Id: linux Crash Type: Uncaught exception Crash Address: Crash State: com.ctc.wstx.dtd.FullDTDReader.readContentSpec...

GHSA-45RG-G72W-R393 Jenkins allows Deserialization of Untrusted Data via an XML File

Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to execute arbitrary code via serialized data in an XML file, related to XStream and groovy.util.Expando...

Deserialization of Untrusted Data in Jenkins

Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an XStream: Java crash when trying to instantiate void/Void...

Security Bulletin: Security Vulnerability in Xstream Affects IBM Sterling B2B Integrator (CVE-2020-26217)

Summary IBM Sterling B2B Integrator has addressed the security vulnerability. Vulnerability Details CVEID: CVE-2020-26217 DESCRIPTION: XStream could allow a remote attacker to execute arbitrary code on the system, caused by flaws in the XStream.java and SecurityVulnerabilityTest.java scripts. By...

Security Bulletin: IBM Sterling B2B Integrator is vulnerable to multiple vulnerabilities due to Xstream

Summary Xstream is used by IBM Sterling B2B Integrator. Multiple Xstream vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2021-39141 DESCRIPTION: XStream could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization...

GHSA-FWQR-3PVP-PJWQ Deserialization of Untrusted Data in Jenkins

Jenkins before versions 2.44, 2.32.2 is vulnerable to a remote code execution vulnerability involving the deserialization of various types in javax.imageio in XStream-based APIs SECURITY-383...

Deserialization of Untrusted Data in Jenkins

Jenkins before versions 2.44, 2.32.2 is vulnerable to a remote code execution vulnerability involving the deserialization of various types in javax.imageio in XStream-based APIs SECURITY-383...

GHSA-H892-X453-86WC Pippo RCE Vulnerability

Pippo through 1.11.0 allows remote code execution via a command to java.lang.ProcessBuilder because the XstreamEngine component does not use XStream's available protection mechanisms to restrict unmarshalling...

GHSA-GXG6-RC6C-V673 Improper Input Validation in BeanShell

BeanShell bsh before 2.0b6, when included on the classpath by an application that uses Java serialization or XStream, allows remote attackers to execute arbitrary code via crafted serialized data, related to XThis.Handler...

Improper Input Validation in BeanShell

BeanShell bsh before 2.0b6, when included on the classpath by an application that uses Java serialization or XStream, allows remote attackers to execute arbitrary code via crafted serialized data, related to XThis.Handler...

xstream:XmlFuzzer: Uncaught exception in com.thoughtworks.xstream.core.TreeUnmarshaller.convertAnother

Project: https://github.com/x-stream/xstream.git Detailed Report: https://oss-fuzz.com/testcase?key=4827085820002304 Project: xstream Fuzzing Engine: libFuzzer Fuzz Target: XmlFuzzer Job Type: libfuzzerasanxstream Platform Id: linux Crash Type: Uncaught exception Crash Address: Crash State:...

xstream:XmlFuzzer: Uncaught exception in jaz.Zer.<clinit>

Project: https://github.com/x-stream/xstream.git Detailed Report: https://oss-fuzz.com/testcase?key=5154059834753024 Project: xstream Fuzzing Engine: libFuzzer Fuzz Target: XmlFuzzer Job Type: libfuzzerasanxstream Platform Id: linux Crash Type: Uncaught exception Crash Address: Crash State:...

NewStart CGSL CORE 5.05 / MAIN 5.05 : xstream Vulnerability (NS-SA-2022-0045)

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has xstream packages installed that are affected by a vulnerability: - XStream is software for serializing Java objects to XML and back again. A vulnerability in XStream versions prior to 1.4.17 may allow a remote attacker has...

NewStart CGSL CORE 5.05 / MAIN 5.05 : xstream Multiple Vulnerabilities (NS-SA-2022-0033)

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has xstream packages installed that are affected by multiple vulnerabilities: - XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a...

NewStart CGSL CORE 5.04 / MAIN 5.04 : xstream Vulnerability (NS-SA-2022-0007)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has xstream packages installed that are affected by a vulnerability: - XStream is software for serializing Java objects to XML and back again. A vulnerability in XStream versions prior to 1.4.17 may allow a remote attacker has...

Security Bulletin: IBM InfoSphere Information Server is affected by multiple vulnerabilities in XStream

Summary Multiple vulnerabilities in XStream that is used by IBM InfoSphere Information Server were addressed. Vulnerability Details CVEID:CVE-2021-39145 DESCRIPTION: XStream could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization...

xstream: Injecting highly recursive collections or maps can cause a DoS

XStream is an open source java library to serialize objects to XML and back again. Versions prior to 1.4.19 may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a payload resulting in a denial of service only by manipulatin...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in XStream

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of XStream. Vulnerability Details CVEID: CVE-2021-43859 DESCRIPTION: XStream is vulnerable to a denial of service, caused by improper input validation. By injecting highly recursive collections or maps, a remote...

XStream: SSRF can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream. No user is...

Important: Red Hat Security Advisory: Red Hat Integration Camel-K 1.6.4 release and security update

A micro version update from 1.6.3 to 1.6.4 is now available for Red Hat Integration Camel K that includes bug fixes and enhancements. The purpose of this text-only errata is to inform you about the security issues fixed in this release. Red Hat Product Security has rated this update as having a...