CVE-2019-10173 - 漏洞详情

CVE-2019-10173 (CNNVD-201907-1192)

HIGH

中文标题:

XStream 代码注入漏洞

英文标题:

It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous de...

CVSS分数: 7.3

发布时间: 2019-07-23 12:50:44

漏洞类型: 代码注入

状态: PUBLISHED

数据质量分数: 0.30

数据版本: v3

漏洞描述

中文描述:

XStream是XStream（Xstream）团队的一个轻量级的、简单易用的开源Java类库，它主要用于将对象序列化成XML（JSON）或反序列化为对象。 xstream 1.4.10版本中存在代码注入漏洞。该漏洞源于网络系统或产品的代码开发过程中存在设计或实现不当的问题。

英文描述:

It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw. If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when unmarshalling XML or any supported format. e.g. JSON. (regression of CVE-2013-7285)

CWE类型:

CWE-94 CWE-502

受影响产品

厂商	产品	版本	版本范围	平台	CPE
xstream	xstream	fixed in 1.4.11	-	-	`cpe:2.3:a:xstream:xstream:fixed_in_1.4.11:::::::*`
xstream	xstream	1.4.10	-	-	`cpe:2.3:a:xstream:xstream:1.4.10:::::::*`
oracle	banking_platform	*	-	-	`cpe:2.3:a:oracle:banking_platform::::::::`
oracle	banking_platform	2.4.0	-	-	`cpe:2.3:a:oracle:banking_platform:2.4.0:::::::*`
oracle	banking_platform	2.7.1	-	-	`cpe:2.3:a:oracle:banking_platform:2.7.1:::::::*`
oracle	banking_platform	2.9.0	-	-	`cpe:2.3:a:oracle:banking_platform:2.9.0:::::::*`
oracle	business_activity_monitoring	11.1.1.9.0	-	-	`cpe:2.3:a:oracle:business_activity_monitoring:11.1.1.9.0:::::::*`
oracle	business_activity_monitoring	12.2.1.3.0	-	-	`cpe:2.3:a:oracle:business_activity_monitoring:12.2.1.3.0:::::::*`
oracle	business_activity_monitoring	12.2.1.4.0	-	-	`cpe:2.3:a:oracle:business_activity_monitoring:12.2.1.4.0:::::::*`
oracle	communications_billing_and_revenue_management_elastic_charging_engine	11.3.0.9.0	-	-	`cpe:2.3:a:oracle:communications_billing_and_revenue_management_elastic_charging_engine:11.3.0.9.0:::::::*`
oracle	communications_billing_and_revenue_management_elastic_charging_engine	12.0.0.3.0	-	-	`cpe:2.3:a:oracle:communications_billing_and_revenue_management_elastic_charging_engine:12.0.0.3.0:::::::*`
oracle	communications_diameter_signaling_router	*	-	-	`cpe:2.3:a:oracle:communications_diameter_signaling_router::::::::`
oracle	communications_unified_inventory_management	7.3.0	-	-	`cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.0:::::::*`
oracle	communications_unified_inventory_management	7.4.0	-	-	`cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.0:::::::*`
oracle	endeca_information_discovery_studio	3.2.0	-	-	`cpe:2.3:a:oracle:endeca_information_discovery_studio:3.2.0:::::::*`
oracle	endeca_information_discovery_studio	3.2.0.0	-	-	`cpe:2.3:a:oracle:endeca_information_discovery_studio:3.2.0.0:::::::*`
oracle	retail_xstore_point_of_service	17.0	-	-	`cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0:::::::*`
oracle	utilities_framework	*	-	-	`cpe:2.3:a:oracle:utilities_framework::::::::`
oracle	utilities_framework	2.2.0.0.0	-	-	`cpe:2.3:a:oracle:utilities_framework:2.2.0.0.0:::::::*`
oracle	utilities_framework	4.2.0.2.0	-	-	`cpe:2.3:a:oracle:utilities_framework:4.2.0.2.0:::::::*`
oracle	utilities_framework	4.2.0.3.0	-	-	`cpe:2.3:a:oracle:utilities_framework:4.2.0.3.0:::::::*`
oracle	utilities_framework	4.4.0.0.0	-	-	`cpe:2.3:a:oracle:utilities_framework:4.4.0.0.0:::::::*`
oracle	webcenter_portal	11.1.1.9.0	-	-	`cpe:2.3:a:oracle:webcenter_portal:11.1.1.9.0:::::::*`
oracle	webcenter_portal	12.2.1.3.0	-	-	`cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:::::::*`
oracle	webcenter_portal	12.2.1.4.0	-	-	`cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0:::::::*`

解决方案

中文解决方案:

（暂无数据）

英文解决方案:

（暂无数据）

临时解决方案:

（暂无数据）

参考链接

RHSA-2019:3892 vendor-advisory
cve.org

访问

RHSA-2019:4352 vendor-advisory
cve.org

访问

RHSA-2020:0445 vendor-advisory
cve.org

访问

RHSA-2020:0727 vendor-advisory
cve.org

访问