CVE-2019-10173 Deserialization of Untrusted Data and Code Injection in xstream
CriticalCVSS 9.8
EPSS 95.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw. If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when unmarshalling XML or any supported format. e.g. JSON. (regression of CVE-2013-7285)
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| com.thoughtworks.xstream/xstream(Maven) | >= 1.4.10, < 1.4.11 | 1.4.11 |
| com.thoughtworks.xstream/xstream(Maven) | = 1.4.10 | No fix listed |
| com.thoughtworks.xstream/xstream(Maven) | = 1.4.10-java7 | No fix listed |
| debian/libxstream-java(Debian:12) | < 1.4.11-1 | 1.4.11-1 |
| debian/libxstream-java(Debian:13) | < 1.4.11-1 | 1.4.11-1 |
| debian/libxstream-java(Debian:14) | < 1.4.11-1 | 1.4.11-1 |
| xstream | = 1.4.10 | No fix listed |
| oracle banking platform | >= 2.4.0, <= 2.10.0 | No fix listed |
| oracle banking platform | = 2.4.0 | No fix listed |
| oracle banking platform | = 2.7.1 | No fix listed |
| oracle banking platform | = 2.9.0 | No fix listed |
| oracle business activity monitoring | = 11.1.1.9.0 | No fix listed |
| oracle business activity monitoring | = 12.2.1.3.0 | No fix listed |
| oracle business activity monitoring | = 12.2.1.4.0 | No fix listed |
| oracle communications billing and revenue management elastic charging engine | = 11.3.0.9.0 | No fix listed |
| oracle communications billing and revenue management elastic charging engine | = 12.0.0.3.0 | No fix listed |
| oracle communications diameter signaling router | >= 8.0.0, <= 8.2.2 | No fix listed |
| oracle communications unified inventory management | = 7.3.0 | No fix listed |
| oracle communications unified inventory management | = 7.4.0 | No fix listed |
| oracle endeca information discovery studio | = 3.2.0 | No fix listed |
| oracle endeca information discovery studio | = 3.2.0.0 | No fix listed |
| oracle retail xstore point of service | = 17.0 | No fix listed |
| oracle utilities framework | >= 4.3.0.1.0, <= 4.3.0.6.0 | No fix listed |
| oracle utilities framework | = 2.2.0.0.0 | No fix listed |
| oracle utilities framework | = 4.2.0.2.0 | No fix listed |
Show 6 more
| Product | Affected versions | Fixed in |
|---|---|---|
| oracle utilities framework | = 4.2.0.3.0 | No fix listed |
| oracle utilities framework | = 4.4.0.0.0 | No fix listed |
| oracle webcenter portal | = 11.1.1.9.0 | No fix listed |
| oracle webcenter portal | = 12.2.1.3.0 | No fix listed |
| oracle webcenter portal | = 12.2.1.4.0 | No fix listed |
| xstream | = fixed in 1.4.11 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- RHSA-2019:3892 third-party-advisory vendor-advisory
- RHSA-2019:4352 third-party-advisory vendor-advisory
- RHSA-2020:0445 third-party-advisory vendor-advisory
- RHSA-2020:0727 third-party-advisory vendor-advisory
- bugzilla.redhat.com issue-tracking third-party-advisory
- github.com product
- www.oracle.com patch third-party-advisory
- www.oracle.com patch third-party-advisory
- www.oracle.com third-party-advisory
- www.oracle.com third-party-advisory
- www.oracle.com third-party-advisory
- x-stream.github.io release-notes third-party-advisory
- Debian Security Tracker CVE-2019-10173 vendor-advisory
- github.com