Fluid Attacks Database

Description

Deserialization of Untrusted Data and Code Injection in xstream It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw. If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when unmarshalling XML or any supported format. e.g. JSON. (regression of CVE-2013-7285)

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
maven	com.thoughtworks.xstream:xstream	=1.4.10 \|\| >=1.4.10 <1.4.11	1.4.11
debian 11	libxstream-java	>=0 <1.4.11-1	1.4.11-1
debian 13	libxstream-java	>=0 <1.4.11-1	1.4.11-1
debian 14	libxstream-java	>=0 <1.4.11-1	1.4.11-1
debian 12	libxstream-java	>=0 <1.4.11-1	1.4.11-1

Aliases

1. CVE-2019-101732. NVD-2019-101733. OSV-2019-101734. OSV-DEBIAN-2019-101735. GCVE-2019-101736. access.redhat.com7. access.redhat.com8. access.redhat.com9. access.redhat.com10. SECURITY-TRACKER-CVE-2019-10173

References

1. https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-101732. https://www.oracle.com//security-alerts/cpujul2021.html3. https://www.oracle.com/security-alerts/cpuApr2021.html4. https://www.oracle.com/security-alerts/cpuapr2020.html5. https://www.oracle.com/security-alerts/cpujan2021.html6. https://www.oracle.com/security-alerts/cpuoct2020.html7. http://x-stream.github.io/changes.html#1.4.11

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.