CVE-2020-26259
Summary
| CVE | CVE-2020-26259 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2020-12-16 01:15:00 UTC |
|---|
| Updated | 2023-11-07 03:20:00 UTC |
|---|
| Description | XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling. The vulnerability may allow a remote attacker to delete arbitrary know files on the host as log as the executing process has sufficient rights only by manipulating the processed input stream. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.15. The reported vulnerability does not exist running Java 15 or higher. No user is affected, who followed the recommendation to setup XStream's Security Framework with a whitelist! Anyone relying on XStream's default blacklist can immediately switch to a whilelist for the allowed types to avoid the vulnerability. Users of XStream 1.4.14 or below who still want to use XStream default blacklist can use a workaround described in more detailed in the referenced advisories. |
|---|
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|
| XStream is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling · Advisory · x-stream/xstream · GitHub |
CONFIRM |
github.com |
Mitigation, Third Party Advisory |
| [SECURITY] Fedora 34 Update: xstream-1.4.18-2.fc34 - package-announce - Fedora Mailing-Lists |
FEDORA |
lists.fedoraproject.org |
|
| [SECURITY] Fedora 33 Update: xstream-1.4.18-2.fc33 - package-announce - Fedora Mailing-Lists |
|
lists.fedoraproject.org |
|
| XStream - CVE-2020-26259 |
MISC |
x-stream.github.io |
Exploit, Mitigation, Third Party Advisory |
| Debian -- Security Information -- DSA-4828-1 libxstream-java |
DEBIAN |
www.debian.org |
Third Party Advisory |
| [SECURITY] [DLA 2507-1] libxstream-java security update |
MLIST |
lists.debian.org |
Mailing List, Third Party Advisory |
| [SECURITY] Fedora 34 Update: xstream-1.4.18-2.fc34 - package-announce - Fedora Mailing-Lists |
|
lists.fedoraproject.org |
|
| December 2020 XStream Vulnerabilities in NetApp Products | NetApp Product Security |
CONFIRM |
security.netapp.com |
|
| [SECURITY] Fedora 35 Update: xstream-1.4.18-2.fc35 - package-announce - Fedora Mailing-Lists |
|
lists.fedoraproject.org |
|
| Pony Mail! |
MLIST |
lists.apache.org |
Mailing List, Patch, Third Party Advisory |
| [SECURITY] Fedora 33 Update: xstream-1.4.18-2.fc33 - package-announce - Fedora Mailing-Lists |
FEDORA |
lists.fedoraproject.org |
|
| [SECURITY] Fedora 35 Update: xstream-1.4.18-2.fc35 - package-announce - Fedora Mailing-Lists |
FEDORA |
lists.fedoraproject.org |
|
| Pony Mail! |
|
lists.apache.org |
|
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 174824 SUSE Enterprise Linux Security update for SUSE Manager Server 4.1 (SUSE-SU-2021:0906-1)
- 198361 Ubuntu Security Notification for XStream vulnerabilities (USN-4943-1)
- 281980 Fedora Security Update for xstream (FEDORA-2021-d894ca87dc)
- 281981 Fedora Security Update for xstream (FEDORA-2021-fbad11014a)
- 375337 IBM Spectrum Control Multiple Vulnerability(6415993)
- 375827 XStream Arbitrary Code Execution And Multiple vulnerabilities
- 750401 OpenSUSE Security Update for xstream (openSUSE-SU-2021:0140-1)
- 980089 Java (maven) Security Update for com.thoughtworks.xstream:xstream (GHSA-jfvx-7wrx-43fh)
