Most recent entries from all

bdu:2020-05622

BIT-activemq-2020-26217 — Remote Code Execution in XStream

Affected: Bitnami: activemq

XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream. Only users who rely on blocklists are affected. Anyone using XStream's Security Framework allowlist is not affected. The linked advisory provides code workarounds for users who cannot upgrade. The issue is fixed in version 1.4.14.

certfr-2021-avi-490 — De multiples vulnérabilités ont été découvertes dans IBM Spectrum Protect. Certaines d'entre elles permettent à un atta…

certfr-2021-avi-490

cnvd-2020-63975

EUVD-2026-45982

fkie_cve-2020-26217

GHSA-mw36-7c6c-q4q2 — XStream can be used for Remote Code Execution

Affected: Maven: com.thoughtworks.xstream:xstream

### Impact The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream.

### Patches If you rely on XStream's default blacklist of the [Security Framework](https://x-stream.github.io/security.html#framework), you will have to use at least version 1.4.14.

### Workarounds No user is affected, who followed the recommendation to setup XStream's Security Framework with a whitelist! Anyone relying on XStream's default blacklist can immediately switch to a whilelist for the allowed types to avoid the vulnerability.

Users of XStream 1.4.13 or below who still want to use XStream default blacklist can use a workaround depending on their version in use.

Users of XStream 1.4.13 can simply add two lines to XStream's setup code: ```Java xstream.denyTypes(new String[]{ "javax.imageio.ImageIO$ContainsFilter" }); xstream.denyTypes(new Class[]{ java.lang.ProcessBuilder.class }); ``` Users of XStream 1.4.12 to 1.4.7 who want to use XStream with a black list will have to setup such a list from scratch and deny at least the following types: _javax.imageio.ImageIO$ContainsFilter_, _java.beans.EventHandler_, _java.lang.ProcessBuilder_, _java.lang.Void_ and _void_. ```Java xstream.denyTypes(new String[]{ "javax.imageio.ImageIO$ContainsFilter" }); xstream.denyTypes(new Class[]{ java.lang.ProcessBuilder.class, java.beans.EventHandler.class, java.lang.ProcessBuilder.class, java.lang.Void.class, void.class }); ``` Users of XStream 1.4…

gsd-2020-26217

openSUSE-SU-2021:0140-1 — Security update for xstream

Security update for xstream

RHSA-2021:0105 — Red Hat Security Advisory: Red Hat Process Automation Manager 7.9.1 security update

XStream: remote code execution due to insecure XML deserialization when relying on blocklists

SUSE-SU-2021:0176-1 — Security update for xstream

Security update for xstream

UBUNTU-CVE-2020-26217

Affected: Ubuntu:Pro:14.04:LTS: libxstream-java, Ubuntu:Pro:16.04:LTS: libxstream-java, Ubuntu:18.04:LTS: libxstream-java, Ubuntu:20.04:LTS: libxstream-java

WID-SEC-W-2024-0094 — Atlassian Bamboo: Mehrere Schwachstellen

Ein entfernter Angreifer kann mehrere Schwachstellen in Atlassian Bamboo ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen, beliebigen Code auszuführen, vertrauliche Informationen offenzulegen oder einen Request Smuggling-Angriff durchzuführen.