|
|
Mark Prins created an issue |
|
Geoserver is using a version of Xstream that has known vulnerabilities |
|
Issue Type: |
|
|---|---|
|
Affects Versions: |
2.15.2, 2.16-RC, 2.15.3, 2.16.0 |
|
Assignee: |
Unassigned |
|
Created: |
21/Aug/19 1:09 PM |
|
Priority: |
|
|
Reporter: |
|
Geoserver is using a version of Xstream that has known vulnerabilities, not sure if this makes GeoServer vulnerable or not, but upgrading is easy enough. CVE-2013-7285 Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. e.g. JSON. CVE-2019-10173 It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw. If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when unmarshalling XML or any supported format. e.g. JSON. (regression of CVE-2013-7285) |
|
|
|
Get Jira notifications on your phone! Download the Jira Cloud app for Android or iOS |
|
|
This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100107-sha1:e5f982f) |
|
|
|