Remote Code Execution in XStream
58Vexday Risk Score
Corrige pronto. Ella tiene exploit funcional público.
ssvc Attendcvss 8epss 85%
probabilidad de explotación
85%top 1% de las CVE
explotación observada
noninguna fuente lo reporta
Lo que declaran los fabricantes (VEX)
Declaraciones oficiales de los fabricantes en formato CSAF/VEX: si su producto está afectado, ya corregido o descartado — y por qué. Es afirmación del fabricante, no juicio de Vexday.
Red Hatdocumento VEX ↗
Afectado
6 productos
Red Hat BPM Suite 6 · Red Hat Integration Camel K 1 · Red Hat Integration Camel Quarkus 1 · Red Hat JBoss BRMS 6 · Red Hat JBoss Data Grid 7 · y otros 1
workaround: Depending on the version of XStream used there are various usage patterns that mitigate this flaw, though we would strongly recommend using the allow list approach if at all possible as there are likely more class combinations the deny list…
Corregido
11 productos (19 componentes)
Red Hat Enterprise Linux Client Optional (v. 7) · Red Hat Enterprise Linux ComputeNode Optional (v. 7) · Red Hat Enterprise Linux Server Optional (v. 7) · Red Hat Enterprise Linux Workstation Optional (v. 7) · RHDM 7.9.1 · y otros 6
No afectado
2 productos (4 componentes) — porque el código vulnerable no está presente en el producto
Red Hat OpenShift Container Platform 3.11 · Red Hat OpenShift Container Platform 4
XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream. Only users who rely on blocklists are affected. Anyone using XStream's Security Framework allowlist is not affected. The linked advisory provides code workarounds for users who cannot upgrade. The issue is fixed in version 1.4.14.
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
Productos afectados
x-stream · xstreamReferencias
https://github.com/x-stream/xstream/commit/0fec095d534126931c99fd38e9c6d41f5c685c1ahttps://github.com/x-stream/xstream/security/advisories/GHSA-mw36-7c6c-q4q2https://lists.apache.org/thread.html/r2de526726e7f4db4a7cb91b7355070779f51a84fd985c6529c2f4e9e%40%3Cissues.activemq.apache.org%3Ehttps://lists.apache.org/thread.html/r7c9fc255edc0b9cd9567093d131f6d33fde4c662aaf912460ef630e9%40%3Ccommits.camel.apache.org%3Ehttps://lists.apache.org/thread.html/r826a006fda71cc96fc87b6eca4b5d195f19a292ad36cea501682c38c%40%3Cissues.activemq.apache.org%3Ehttps://lists.apache.org/thread.html/redde3609b89b2a4ff18b536a06ef9a77deb93d47fda8ed28086fa8c3%40%3Cissues.activemq.apache.org%3Ehttps://lists.debian.org/debian-lts-announce/2020/12/msg00001.htmlhttps://security.netapp.com/advisory/ntap-20210409-0004/https://www.debian.org/security/2020/dsa-4811https://www.oracle.com/security-alerts/cpuApr2021.htmlhttps://www.oracle.com/security-alerts/cpuapr2022.htmlhttps://www.oracle.com/security-alerts/cpujan2022.html