kritik
CVE-2013-7285
XStream: remote code execution due to insecure XML deserialization
En geç 24 Eki 2026, 07:11 UTC tarihinden beri Trivy database'indeO derlemeden önce ne zaman girdiği kayıtlı değil.
Kaynağa göre önem derecesi
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat6.8AV:N/AC:M/Au:N/C:P/I:P/A:P
Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: NVD, GHSA. Daha düşük diyenler: Red Hat (yüksek), Ubuntu (düşük).
Açıklama
Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. e.g. JSON.
Etkilenen paketler ve düzeltilmiş sürümler
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| maven::GitHub Security Advisory Maven | com.thoughtworks.xstream:xstream | 1.4.7, 1.4.11 |
| debian 11 | libxstream-java | 1.4.7-1 |
| debian 12 | libxstream-java | 1.4.7-1 |
| debian 13 | libxstream-java | 1.4.7-1 |
| debian 14 | libxstream-java | 1.4.7-1 |
| echo | libxstream-java | 1.4.7-1 |
| ubuntu 14.04 | libxstream-java | 1.4.7-1 |
| ubuntu 14.04-ESM | libxstream-java | 1.4.7-1 |
| ubuntu 16.04 | libxstream-java | 1.4.7-1 |
| ubuntu 16.04-ESM | libxstream-java | 1.4.7-1 |
| ubuntu 18.04 | libxstream-java | 1.4.7-1 |
| ubuntu 18.04-ESM | libxstream-java | 1.4.7-1 |
13 kaynaktaki 13 kaydın hepsini göster
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| maven::GitHub Security Advisory Maven | com.thoughtworks.xstream:xstream | 1.4.7, 1.4.11 |
| debian 11 | libxstream-java | 1.4.7-1 |
| debian 12 | libxstream-java | 1.4.7-1 |
| debian 13 | libxstream-java | 1.4.7-1 |
| debian 14 | libxstream-java | 1.4.7-1 |
| echo | libxstream-java | 1.4.7-1 |
| ubuntu 14.04 | libxstream-java | 1.4.7-1 |
| ubuntu 14.04-ESM | libxstream-java | 1.4.7-1 |
| ubuntu 16.04 | libxstream-java | 1.4.7-1 |
| ubuntu 16.04-ESM | libxstream-java | 1.4.7-1 |
| ubuntu 18.04 | libxstream-java | 1.4.7-1 |
| ubuntu 18.04-ESM | libxstream-java | 1.4.7-1 |
| ubuntu 18.10 | libxstream-java | 1.4.7-1 |
Referanslar
- http://blog.diniscruz.com/2013/12/xstream-remote-code-execution-exploit.html
- http://markmail.org/message/kfqoqdfj5fnup5co?q=list:org.codehaus.xstream.dev&page=3
- http://seclists.org/oss-sec/2014/q1/69
- http://web.archive.org/web/20140204133306/http://blog.diniscruz.com/2013/12/xstream-remote-code-execution-exploit.html
- http://xstream.codehaus.org/security.html
- https://access.redhat.com/security/cve/CVE-2013-7285
- https://fisheye.codehaus.org/changelog/xstream?cs=2210
- https://github.com/x-stream/xstream/commit/6344867dce6767af7d0fe34fb393271a6456672d
17 referansın hepsi
- https://lists.apache.org/thread.html/6d3d34adcf3dfc48e36342aa1f18ce3c20bb8e4c458a97508d5bfed1@%3Cissues.activemq.apache.org%3E
- https://lists.apache.org/thread.html/dcf8599b80e43a6b60482607adb76c64672772dc2d9209ae2170f369@%3Cissues.activemq.apache.org%3E
- https://nvd.nist.gov/vuln/detail/CVE-2013-7285
- https://securityblog.redhat.com/2014/01/23/java-deserialization-flaws-part-2-xml-deserialization/
- https://www.cve.org/CVERecord?id=CVE-2013-7285
- https://www.mail-archive.com/user@xstream.codehaus.org/msg00604.html
- https://www.mail-archive.com/user@xstream.codehaus.org/msg00607.html
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://x-stream.github.io/CVE-2013-7285.html