CVE-2020-26217highCWE-78

CVE-2020-26217: high-severity vulnerability in x-stream xstream

Remote Code Execution in XStream

Published · Updated

Follow this CVE+ Monitor xstream+ Monitor libxstream-java

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

58Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendcvss 8epss 85%
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Affected
6 products
Red Hat BPM Suite 6 · Red Hat Integration Camel K 1 · Red Hat Integration Camel Quarkus 1 · Red Hat JBoss BRMS 6 · Red Hat JBoss Data Grid 7 · and others 1
workaround: Depending on the version of XStream used there are various usage patterns that mitigate this flaw, though we would strongly recommend using the allow list approach if at all possible as there are likely more class combinations the deny list…
Fixed
11 products (19 components)
Red Hat Enterprise Linux Client Optional (v. 7) · Red Hat Enterprise Linux ComputeNode Optional (v. 7) · Red Hat Enterprise Linux Server Optional (v. 7) · Red Hat Enterprise Linux Workstation Optional (v. 7) · RHDM 7.9.1 · and others 6
fix ↗
Not affected
2 products (4 components) — because the vulnerable code is not present in the product
Red Hat OpenShift Container Platform 3.11 · Red Hat OpenShift Container Platform 4
XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream. Only users who rely on blocklists are affected. Anyone using XStream's Security Framework allowlist is not affected. The linked advisory provides code workarounds for users who cannot upgrade. The issue is fixed in version 1.4.14.
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
Affected products
x-stream · xstream
Related CVEs — x-stream xstream

In the same product, most dangerous first.

CVE-2021-39144HIGHXStream is vulnerable to a Remote Command Execution attackEPSS 98.1%KEVCVE-2020-26259MEDIUMXStream is vulnerable to an Arbitrary File Deletion on the local host when unmarshallingEPSS 82.4%CVE-2021-21351MEDIUMXStream is vulnerable to an Arbitrary Code Execution attackEPSS 82.1%CVE-2020-26258MEDIUMServer-Side Forgery Request can be activated unmarshalling with XStreamEPSS 81.8%CVE-2021-21341HIGHXStream can cause a Denial of ServiceEPSS 77.8%CVE-2021-29505HIGHXStream is vulnerable to a Remote Command Execution attackEPSS 77.2%