kritisch
CVE-2013-7285
XStream: remote code execution due to insecure XML deserialization
In der Trivy Database seit spätestens 24. Okt. 2026, 07:11 UTCWann der Eintrag vor diesem Build hinzukam, ist nicht erfasst.
Einstufung nach Quelle
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat6.8AV:N/AC:M/Au:N/C:P/I:P/A:P
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD, GHSA. Niedriger laut Red Hat (hoch), Ubuntu (niedrig).
Beschreibung
Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. e.g. JSON.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| maven::GitHub Security Advisory Maven | com.thoughtworks.xstream:xstream | 1.4.7, 1.4.11 |
| debian 11 | libxstream-java | 1.4.7-1 |
| debian 12 | libxstream-java | 1.4.7-1 |
| debian 13 | libxstream-java | 1.4.7-1 |
| debian 14 | libxstream-java | 1.4.7-1 |
| echo | libxstream-java | 1.4.7-1 |
| ubuntu 14.04 | libxstream-java | 1.4.7-1 |
| ubuntu 14.04-ESM | libxstream-java | 1.4.7-1 |
| ubuntu 16.04 | libxstream-java | 1.4.7-1 |
| ubuntu 16.04-ESM | libxstream-java | 1.4.7-1 |
| ubuntu 18.04 | libxstream-java | 1.4.7-1 |
| ubuntu 18.04-ESM | libxstream-java | 1.4.7-1 |
Alle 13 Einträge aus 13 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| maven::GitHub Security Advisory Maven | com.thoughtworks.xstream:xstream | 1.4.7, 1.4.11 |
| debian 11 | libxstream-java | 1.4.7-1 |
| debian 12 | libxstream-java | 1.4.7-1 |
| debian 13 | libxstream-java | 1.4.7-1 |
| debian 14 | libxstream-java | 1.4.7-1 |
| echo | libxstream-java | 1.4.7-1 |
| ubuntu 14.04 | libxstream-java | 1.4.7-1 |
| ubuntu 14.04-ESM | libxstream-java | 1.4.7-1 |
| ubuntu 16.04 | libxstream-java | 1.4.7-1 |
| ubuntu 16.04-ESM | libxstream-java | 1.4.7-1 |
| ubuntu 18.04 | libxstream-java | 1.4.7-1 |
| ubuntu 18.04-ESM | libxstream-java | 1.4.7-1 |
| ubuntu 18.10 | libxstream-java | 1.4.7-1 |
Referenzen
- http://blog.diniscruz.com/2013/12/xstream-remote-code-execution-exploit.html
- http://markmail.org/message/kfqoqdfj5fnup5co?q=list:org.codehaus.xstream.dev&page=3
- http://seclists.org/oss-sec/2014/q1/69
- http://web.archive.org/web/20140204133306/http://blog.diniscruz.com/2013/12/xstream-remote-code-execution-exploit.html
- http://xstream.codehaus.org/security.html
- https://access.redhat.com/security/cve/CVE-2013-7285
- https://fisheye.codehaus.org/changelog/xstream?cs=2210
- https://github.com/x-stream/xstream/commit/6344867dce6767af7d0fe34fb393271a6456672d
Alle 17 Referenzen
- https://lists.apache.org/thread.html/6d3d34adcf3dfc48e36342aa1f18ce3c20bb8e4c458a97508d5bfed1@%3Cissues.activemq.apache.org%3E
- https://lists.apache.org/thread.html/dcf8599b80e43a6b60482607adb76c64672772dc2d9209ae2170f369@%3Cissues.activemq.apache.org%3E
- https://nvd.nist.gov/vuln/detail/CVE-2013-7285
- https://securityblog.redhat.com/2014/01/23/java-deserialization-flaws-part-2-xml-deserialization/
- https://www.cve.org/CVERecord?id=CVE-2013-7285
- https://www.mail-archive.com/user@xstream.codehaus.org/msg00604.html
- https://www.mail-archive.com/user@xstream.codehaus.org/msg00607.html
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://x-stream.github.io/CVE-2013-7285.html