Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2016-3674 (GCVE-0-2016-3674)
Vulnerability from cvelistv5 – Published: 2016-05-17 14:00 – Updated: 2024-08-06 00:03
VLAI?
EPSS
Summary
Multiple XML external entity (XXE) vulnerabilities in the (1) Dom4JDriver, (2) DomDriver, (3) JDomDriver, (4) JDom2Driver, (5) SjsxpDriver, (6) StandardStaxDriver, and (7) WstxDriver drivers in XStream before 1.4.9 allow remote attackers to read arbitrary files via a crafted XML document.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T00:03:34.422Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://x-stream.github.io/changes.html#1.4.9"
},
{
"name": "FEDORA-2016-de909cc333",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183180.html"
},
{
"name": "DSA-3575",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2016/dsa-3575"
},
{
"name": "RHSA-2016:2822",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2016-2822.html"
},
{
"name": "85381",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/85381"
},
{
"name": "1036419",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id/1036419"
},
{
"name": "[oss-security] 20160328 Re: CVE request - XStream: XXE vulnerability",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2016/03/28/1"
},
{
"name": "RHSA-2016:2823",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2016-2823.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/x-stream/xstream/issues/25"
},
{
"name": "[oss-security] 20160325 CVE request - XStream: XXE vulnerability",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2016/03/25/8"
},
{
"name": "FEDORA-2016-250042b8a6",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183208.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-03-15T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Multiple XML external entity (XXE) vulnerabilities in the (1) Dom4JDriver, (2) DomDriver, (3) JDomDriver, (4) JDom2Driver, (5) SjsxpDriver, (6) StandardStaxDriver, and (7) WstxDriver drivers in XStream before 1.4.9 allow remote attackers to read arbitrary files via a crafted XML document."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-01-04T19:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://x-stream.github.io/changes.html#1.4.9"
},
{
"name": "FEDORA-2016-de909cc333",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183180.html"
},
{
"name": "DSA-3575",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2016/dsa-3575"
},
{
"name": "RHSA-2016:2822",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2016-2822.html"
},
{
"name": "85381",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/85381"
},
{
"name": "1036419",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id/1036419"
},
{
"name": "[oss-security] 20160328 Re: CVE request - XStream: XXE vulnerability",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2016/03/28/1"
},
{
"name": "RHSA-2016:2823",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2016-2823.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/x-stream/xstream/issues/25"
},
{
"name": "[oss-security] 20160325 CVE request - XStream: XXE vulnerability",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2016/03/25/8"
},
{
"name": "FEDORA-2016-250042b8a6",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183208.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-3674",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple XML external entity (XXE) vulnerabilities in the (1) Dom4JDriver, (2) DomDriver, (3) JDomDriver, (4) JDom2Driver, (5) SjsxpDriver, (6) StandardStaxDriver, and (7) WstxDriver drivers in XStream before 1.4.9 allow remote attackers to read arbitrary files via a crafted XML document."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://x-stream.github.io/changes.html#1.4.9",
"refsource": "CONFIRM",
"url": "http://x-stream.github.io/changes.html#1.4.9"
},
{
"name": "FEDORA-2016-de909cc333",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183180.html"
},
{
"name": "DSA-3575",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2016/dsa-3575"
},
{
"name": "RHSA-2016:2822",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2016-2822.html"
},
{
"name": "85381",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/85381"
},
{
"name": "1036419",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id/1036419"
},
{
"name": "[oss-security] 20160328 Re: CVE request - XStream: XXE vulnerability",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2016/03/28/1"
},
{
"name": "RHSA-2016:2823",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2016-2823.html"
},
{
"name": "https://github.com/x-stream/xstream/issues/25",
"refsource": "CONFIRM",
"url": "https://github.com/x-stream/xstream/issues/25"
},
{
"name": "[oss-security] 20160325 CVE request - XStream: XXE vulnerability",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2016/03/25/8"
},
{
"name": "FEDORA-2016-250042b8a6",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183208.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-3674",
"datePublished": "2016-05-17T14:00:00",
"dateReserved": "2016-03-28T00:00:00",
"dateUpdated": "2024-08-06T00:03:34.422Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"fkie_nvd": {
"configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:fedoraproject:fedora:22:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"253C303A-E577-4488-93E6-68A8DD942C38\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:fedoraproject:fedora:23:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"E79AB8DD-C907-4038-A931-1A5A4CFB6A5B\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:xstream_project:xstream:*:*:*:*:*:*:*:*\", \"versionEndIncluding\": \"1.4.8\", \"matchCriteriaId\": \"C28FD033-842F-4762-A6B5-6CAB93A17A4A\"}]}]}]",
"descriptions": "[{\"lang\": \"en\", \"value\": \"Multiple XML external entity (XXE) vulnerabilities in the (1) Dom4JDriver, (2) DomDriver, (3) JDomDriver, (4) JDom2Driver, (5) SjsxpDriver, (6) StandardStaxDriver, and (7) WstxDriver drivers in XStream before 1.4.9 allow remote attackers to read arbitrary files via a crafted XML document.\"}, {\"lang\": \"es\", \"value\": \"M\\u00faltiples vulnerabilidades de entidad externa (XXE) en (1) Dom4JDriver, (2) DomDriver, (3) JDom Driver, (4) JDom2Driver, (5) SjsxpDriver, (6) StandardStaxDriver y (7) WstxDriver drivers en XStream en versiones anteriores a 1.4.9 permiten a atacantes remotos leer archivos arbitrarios a trav\\u00e9s de un documento XML manipulado.\"}]",
"id": "CVE-2016-3674",
"lastModified": "2024-11-21T02:50:29.187",
"metrics": "{\"cvssMetricV30\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.0\", \"vectorString\": \"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\", \"baseScore\": 7.5, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 3.6}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:L/Au:N/C:P/I:N/A:N\", \"baseScore\": 5.0, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"LOW\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"PARTIAL\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"baseSeverity\": \"MEDIUM\", \"exploitabilityScore\": 10.0, \"impactScore\": 2.9, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
"published": "2016-05-17T14:08:03.607",
"references": "[{\"url\": \"http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183180.html\", \"source\": \"cve@mitre.org\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183208.html\", \"source\": \"cve@mitre.org\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"http://rhn.redhat.com/errata/RHSA-2016-2822.html\", \"source\": \"cve@mitre.org\", \"tags\": [\"Broken Link\"]}, {\"url\": \"http://rhn.redhat.com/errata/RHSA-2016-2823.html\", \"source\": \"cve@mitre.org\", \"tags\": [\"Broken Link\"]}, {\"url\": \"http://www.debian.org/security/2016/dsa-3575\", \"source\": \"cve@mitre.org\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"http://www.openwall.com/lists/oss-security/2016/03/25/8\", \"source\": \"cve@mitre.org\", \"tags\": [\"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"http://www.openwall.com/lists/oss-security/2016/03/28/1\", \"source\": \"cve@mitre.org\", \"tags\": [\"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"http://www.securityfocus.com/bid/85381\", \"source\": \"cve@mitre.org\", \"tags\": [\"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"http://www.securitytracker.com/id/1036419\", \"source\": \"cve@mitre.org\", \"tags\": [\"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"http://x-stream.github.io/changes.html#1.4.9\", \"source\": \"cve@mitre.org\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://github.com/x-stream/xstream/issues/25\", \"source\": \"cve@mitre.org\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183180.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183208.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"http://rhn.redhat.com/errata/RHSA-2016-2822.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Broken Link\"]}, {\"url\": \"http://rhn.redhat.com/errata/RHSA-2016-2823.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Broken Link\"]}, {\"url\": \"http://www.debian.org/security/2016/dsa-3575\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"http://www.openwall.com/lists/oss-security/2016/03/25/8\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"http://www.openwall.com/lists/oss-security/2016/03/28/1\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"http://www.securityfocus.com/bid/85381\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"http://www.securitytracker.com/id/1036419\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"http://x-stream.github.io/changes.html#1.4.9\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://github.com/x-stream/xstream/issues/25\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}]",
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-200\"}]}]"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2016-3674\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2016-05-17T14:08:03.607\",\"lastModified\":\"2025-05-23T17:54:18.250\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Multiple XML external entity (XXE) vulnerabilities in the (1) Dom4JDriver, (2) DomDriver, (3) JDomDriver, (4) JDom2Driver, (5) SjsxpDriver, (6) StandardStaxDriver, and (7) WstxDriver drivers in XStream before 1.4.9 allow remote attackers to read arbitrary files via a crafted XML document.\"},{\"lang\":\"es\",\"value\":\"M\u00faltiples vulnerabilidades de entidad externa (XXE) en (1) Dom4JDriver, (2) DomDriver, (3) JDom Driver, (4) JDom2Driver, (5) SjsxpDriver, (6) StandardStaxDriver y (7) WstxDriver drivers en XStream en versiones anteriores a 1.4.9 permiten a atacantes remotos leer archivos arbitrarios a trav\u00e9s de un documento XML manipulado.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:P/I:N/A:N\",\"baseScore\":5.0,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":10.0,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-200\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:jboss_middleware:1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1F4A0F87-524E-4935-9B07-93793D8143FD\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fedoraproject:fedora:22:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"253C303A-E577-4488-93E6-68A8DD942C38\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fedoraproject:fedora:23:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E79AB8DD-C907-4038-A931-1A5A4CFB6A5B\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:xstream:xstream:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"1.4.9\",\"matchCriteriaId\":\"78113271-8210-443B-AAB0-E923D14B8F74\"}]}]}],\"references\":[{\"url\":\"http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183180.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\",\"Broken Link\"]},{\"url\":\"http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183208.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\",\"Broken Link\"]},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2016-2822.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Broken Link\"]},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2016-2823.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Broken Link\"]},{\"url\":\"http://www.debian.org/security/2016/dsa-3575\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2016/03/25/8\",\"source\":\"cve@mitre.org\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2016/03/28/1\",\"source\":\"cve@mitre.org\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://www.securityfocus.com/bid/85381\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://www.securitytracker.com/id/1036419\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://x-stream.github.io/changes.html#1.4.9\",\"source\":\"cve@mitre.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://github.com/x-stream/xstream/issues/25\",\"source\":\"cve@mitre.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183180.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"Broken Link\"]},{\"url\":\"http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183208.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"Broken Link\"]},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2016-2822.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Broken Link\"]},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2016-2823.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Broken Link\"]},{\"url\":\"http://www.debian.org/security/2016/dsa-3575\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2016/03/25/8\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2016/03/28/1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://www.securityfocus.com/bid/85381\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://www.securitytracker.com/id/1036419\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://x-stream.github.io/changes.html#1.4.9\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://github.com/x-stream/xstream/issues/25\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]}]}}"
}
}
RHSA-2016:2823
Vulnerability from csaf_redhat - Published: 2016-11-28 17:55 - Updated: 2025-11-21 17:58Summary
Red Hat Security Advisory: Red Hat JBoss BRMS security update
Notes
Topic
An update is now available for Red Hat JBoss BRMS.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
This release of Red Hat JBoss BRMS 6.4.0 serves as a replacement for Red Hat JBoss BRMS 6.3.4, and includes bug fixes and enhancements, which are documented in the Release Notes of the patch linked to in the References section.
Security Fix(es):
* It was found that several XML parsers used by XStream had default settings that would expand entity references. A remote, unauthenticated attacker could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks. (CVE-2016-3674)
* Drools Workbench contains the path traversal vulnerability. The vulnerability allows a remote, authenticated attacker to bypass the directory restrictions and retrieve arbitrary files from the affected host. (CVE-2016-7041)
* JBoss BRMS 6 and BPM Suite 6 are vulnerable to a stored XSS via business process editor. The flaw is due to an incomplete fix for CVE-2016-5398. Remote, authenticated attackers that have privileges to create business processes can store scripts in them, which are not properly sanitized before showing to other users, including admins. (CVE-2016-8608)
Red Hat would like to thank Jonas Bauters (NVISO) for reporting CVE-2016-7041. The CVE-2016-8608 issue was discovered by Kirill Gaevskii (Red Hat).
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update is now available for Red Hat JBoss BRMS.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "This release of Red Hat JBoss BRMS 6.4.0 serves as a replacement for Red Hat JBoss BRMS 6.3.4, and includes bug fixes and enhancements, which are documented in the Release Notes of the patch linked to in the References section.\n\nSecurity Fix(es):\n\n* It was found that several XML parsers used by XStream had default settings that would expand entity references. A remote, unauthenticated attacker could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks. (CVE-2016-3674)\n\n* Drools Workbench contains the path traversal vulnerability. The vulnerability allows a remote, authenticated attacker to bypass the directory restrictions and retrieve arbitrary files from the affected host. (CVE-2016-7041)\n\n* JBoss BRMS 6 and BPM Suite 6 are vulnerable to a stored XSS via business process editor. The flaw is due to an incomplete fix for CVE-2016-5398. Remote, authenticated attackers that have privileges to create business processes can store scripts in them, which are not properly sanitized before showing to other users, including admins. (CVE-2016-8608)\n\nRed Hat would like to thank Jonas Bauters (NVISO) for reporting CVE-2016-7041. The CVE-2016-8608 issue was discovered by Kirill Gaevskii (Red Hat).",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2016:2823",
"url": "https://access.redhat.com/errata/RHSA-2016:2823"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=brms\u0026downloadType=distributions\u0026version=6.4",
"url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=brms\u0026downloadType=distributions\u0026version=6.4"
},
{
"category": "external",
"summary": "1321789",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1321789"
},
{
"category": "external",
"summary": "1375757",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1375757"
},
{
"category": "external",
"summary": "1386806",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1386806"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_2823.json"
}
],
"title": "Red Hat Security Advisory: Red Hat JBoss BRMS security update",
"tracking": {
"current_release_date": "2025-11-21T17:58:44+00:00",
"generator": {
"date": "2025-11-21T17:58:44+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.12"
}
},
"id": "RHSA-2016:2823",
"initial_release_date": "2016-11-28T17:55:19+00:00",
"revision_history": [
{
"date": "2016-11-28T17:55:19+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2019-02-20T12:43:59+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2025-11-21T17:58:44+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat JBoss BRMS 6.3",
"product": {
"name": "Red Hat JBoss BRMS 6.3",
"product_id": "Red Hat JBoss BRMS 6.3",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:jboss_enterprise_brms_platform:6.3"
}
}
}
],
"category": "product_family",
"name": "Red Hat Decision Manager"
}
],
"category": "vendor",
"name": "Red Hat"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2016-3674",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"discovery_date": "2016-03-25T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1321789"
}
],
"notes": [
{
"category": "description",
"text": "It was found that several XML parsers used by XStream had default settings that would expand entity references. A remote, unauthenticated attacker could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "XStream: enabled processing of external entities",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BRMS 6.3"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-3674"
},
{
"category": "external",
"summary": "RHBZ#1321789",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1321789"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-3674",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-3674"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-3674",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-3674"
},
{
"category": "external",
"summary": "https://github.com/x-stream/xstream/issues/25",
"url": "https://github.com/x-stream/xstream/issues/25"
}
],
"release_date": "2016-03-15T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-11-28T17:55:19+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application Server process before installing this update; after installing the update, restart the server by starting the JBoss Application Server process.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat JBoss BRMS 6.3"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:2823"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"products": [
"Red Hat JBoss BRMS 6.3"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "XStream: enabled processing of external entities"
},
{
"acknowledgments": [
{
"names": [
"Jonas Bauters"
],
"organization": "NVISO"
}
],
"cve": "CVE-2016-7041",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2016-06-26T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1375757"
}
],
"notes": [
{
"category": "description",
"text": "Drools Workbench contains the path traversal vulnerability. The vulnerability allows a remote, authenticated attacker to bypass the directory restrictions and retrieve arbitrary files from the affected host.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Workbench: Path traversal vulnerability",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BRMS 6.3"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-7041"
},
{
"category": "external",
"summary": "RHBZ#1375757",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1375757"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-7041",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-7041"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-7041",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-7041"
}
],
"release_date": "2016-11-28T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-11-28T17:55:19+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application Server process before installing this update; after installing the update, restart the server by starting the JBoss Application Server process.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat JBoss BRMS 6.3"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:2823"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:S/C:C/I:N/A:N",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
},
"products": [
"Red Hat JBoss BRMS 6.3"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Workbench: Path traversal vulnerability"
},
{
"acknowledgments": [
{
"names": [
"Kirill Gaevskii"
],
"organization": "Red Hat",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2016-8608",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2016-10-19T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1386806"
}
],
"notes": [
{
"category": "description",
"text": "JBoss BRMS 6 and BPM Suite 6 are vulnerable to a stored XSS via business process editor. The flaw is due to an incomplete fix for CVE-2016-5398. Remote, authenticated attackers that have privileges to create business processes can store scripts in them, which are not properly sanitized before showing to other users, including admins.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Stored XSS in business process editor",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BRMS 6.3"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-8608"
},
{
"category": "external",
"summary": "RHBZ#1386806",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1386806"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-8608",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-8608"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-8608",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-8608"
}
],
"release_date": "2016-11-28T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-11-28T17:55:19+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application Server process before installing this update; after installing the update, restart the server by starting the JBoss Application Server process.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat JBoss BRMS 6.3"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:2823"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:N",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"Red Hat JBoss BRMS 6.3"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Stored XSS in business process editor"
}
]
}
RHSA-2016_2823
Vulnerability from csaf_redhat - Published: 2016-11-28 17:55 - Updated: 2024-11-22 10:29Summary
Red Hat Security Advisory: Red Hat JBoss BRMS security update
Notes
Topic
An update is now available for Red Hat JBoss BRMS.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
This release of Red Hat JBoss BRMS 6.4.0 serves as a replacement for Red Hat JBoss BRMS 6.3.4, and includes bug fixes and enhancements, which are documented in the Release Notes of the patch linked to in the References section.
Security Fix(es):
* It was found that several XML parsers used by XStream had default settings that would expand entity references. A remote, unauthenticated attacker could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks. (CVE-2016-3674)
* Drools Workbench contains the path traversal vulnerability. The vulnerability allows a remote, authenticated attacker to bypass the directory restrictions and retrieve arbitrary files from the affected host. (CVE-2016-7041)
* JBoss BRMS 6 and BPM Suite 6 are vulnerable to a stored XSS via business process editor. The flaw is due to an incomplete fix for CVE-2016-5398. Remote, authenticated attackers that have privileges to create business processes can store scripts in them, which are not properly sanitized before showing to other users, including admins. (CVE-2016-8608)
Red Hat would like to thank Jonas Bauters (NVISO) for reporting CVE-2016-7041. The CVE-2016-8608 issue was discovered by Kirill Gaevskii (Red Hat).
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update is now available for Red Hat JBoss BRMS.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "This release of Red Hat JBoss BRMS 6.4.0 serves as a replacement for Red Hat JBoss BRMS 6.3.4, and includes bug fixes and enhancements, which are documented in the Release Notes of the patch linked to in the References section.\n\nSecurity Fix(es):\n\n* It was found that several XML parsers used by XStream had default settings that would expand entity references. A remote, unauthenticated attacker could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks. (CVE-2016-3674)\n\n* Drools Workbench contains the path traversal vulnerability. The vulnerability allows a remote, authenticated attacker to bypass the directory restrictions and retrieve arbitrary files from the affected host. (CVE-2016-7041)\n\n* JBoss BRMS 6 and BPM Suite 6 are vulnerable to a stored XSS via business process editor. The flaw is due to an incomplete fix for CVE-2016-5398. Remote, authenticated attackers that have privileges to create business processes can store scripts in them, which are not properly sanitized before showing to other users, including admins. (CVE-2016-8608)\n\nRed Hat would like to thank Jonas Bauters (NVISO) for reporting CVE-2016-7041. The CVE-2016-8608 issue was discovered by Kirill Gaevskii (Red Hat).",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2016:2823",
"url": "https://access.redhat.com/errata/RHSA-2016:2823"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=brms\u0026downloadType=distributions\u0026version=6.4",
"url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=brms\u0026downloadType=distributions\u0026version=6.4"
},
{
"category": "external",
"summary": "1321789",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1321789"
},
{
"category": "external",
"summary": "1375757",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1375757"
},
{
"category": "external",
"summary": "1386806",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1386806"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_2823.json"
}
],
"title": "Red Hat Security Advisory: Red Hat JBoss BRMS security update",
"tracking": {
"current_release_date": "2024-11-22T10:29:53+00:00",
"generator": {
"date": "2024-11-22T10:29:53+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2016:2823",
"initial_release_date": "2016-11-28T17:55:19+00:00",
"revision_history": [
{
"date": "2016-11-28T17:55:19+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2019-02-20T12:43:59+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-22T10:29:53+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat JBoss BRMS 6.3",
"product": {
"name": "Red Hat JBoss BRMS 6.3",
"product_id": "Red Hat JBoss BRMS 6.3",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:jboss_enterprise_brms_platform:6.3"
}
}
}
],
"category": "product_family",
"name": "Red Hat Decision Manager"
}
],
"category": "vendor",
"name": "Red Hat"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2016-3674",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"discovery_date": "2016-03-25T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1321789"
}
],
"notes": [
{
"category": "description",
"text": "It was found that several XML parsers used by XStream had default settings that would expand entity references. A remote, unauthenticated attacker could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "XStream: enabled processing of external entities",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BRMS 6.3"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-3674"
},
{
"category": "external",
"summary": "RHBZ#1321789",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1321789"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-3674",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-3674"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-3674",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-3674"
},
{
"category": "external",
"summary": "https://github.com/x-stream/xstream/issues/25",
"url": "https://github.com/x-stream/xstream/issues/25"
}
],
"release_date": "2016-03-15T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-11-28T17:55:19+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application Server process before installing this update; after installing the update, restart the server by starting the JBoss Application Server process.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat JBoss BRMS 6.3"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:2823"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"products": [
"Red Hat JBoss BRMS 6.3"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "XStream: enabled processing of external entities"
},
{
"acknowledgments": [
{
"names": [
"Jonas Bauters"
],
"organization": "NVISO"
}
],
"cve": "CVE-2016-7041",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2016-06-26T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1375757"
}
],
"notes": [
{
"category": "description",
"text": "Drools Workbench contains the path traversal vulnerability. The vulnerability allows a remote, authenticated attacker to bypass the directory restrictions and retrieve arbitrary files from the affected host.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Workbench: Path traversal vulnerability",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BRMS 6.3"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-7041"
},
{
"category": "external",
"summary": "RHBZ#1375757",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1375757"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-7041",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-7041"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-7041",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-7041"
}
],
"release_date": "2016-11-28T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-11-28T17:55:19+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application Server process before installing this update; after installing the update, restart the server by starting the JBoss Application Server process.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat JBoss BRMS 6.3"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:2823"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:S/C:C/I:N/A:N",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
},
"products": [
"Red Hat JBoss BRMS 6.3"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Workbench: Path traversal vulnerability"
},
{
"acknowledgments": [
{
"names": [
"Kirill Gaevskii"
],
"organization": "Red Hat",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2016-8608",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2016-10-19T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1386806"
}
],
"notes": [
{
"category": "description",
"text": "JBoss BRMS 6 and BPM Suite 6 are vulnerable to a stored XSS via business process editor. The flaw is due to an incomplete fix for CVE-2016-5398. Remote, authenticated attackers that have privileges to create business processes can store scripts in them, which are not properly sanitized before showing to other users, including admins.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Stored XSS in business process editor",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BRMS 6.3"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-8608"
},
{
"category": "external",
"summary": "RHBZ#1386806",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1386806"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-8608",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-8608"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-8608",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-8608"
}
],
"release_date": "2016-11-28T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-11-28T17:55:19+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application Server process before installing this update; after installing the update, restart the server by starting the JBoss Application Server process.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat JBoss BRMS 6.3"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:2823"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:N",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"Red Hat JBoss BRMS 6.3"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Stored XSS in business process editor"
}
]
}
RHSA-2016:2822
Vulnerability from csaf_redhat - Published: 2016-11-28 17:55 - Updated: 2025-11-21 17:58Summary
Red Hat Security Advisory: Red Hat JBoss BPM Suite security update
Notes
Topic
An update is now available for Red Hat JBoss BPM Suite.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
This release of Red Hat JBoss BPM Suite 6.4.0 serves as a replacement for Red Hat JBoss BPM Suite 6.3.4, and includes bug fixes and enhancements, which are documented in the Release Notes of the patch linked to in the References section.
Security Fix(es):
* It was found that several XML parsers used by XStream had default settings that would expand entity references. A remote, unauthenticated attacker could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks. (CVE-2016-3674)
* Drools Workbench contains the path traversal vulnerability. The vulnerability allows a remote, authenticated attacker to bypass the directory restrictions and retrieve arbitrary files from the affected host. (CVE-2016-7041)
* JBoss BRMS 6 and BPM Suite 6 are vulnerable to a stored XSS via business process editor. The flaw is due to an incomplete fix for CVE-2016-5398. Remote, authenticated attackers that have privileges to create business processes can store scripts in them, which are not properly sanitized before showing to other users, including admins. (CVE-2016-8608)
Red Hat would like to thank Jonas Bauters (NVISO) for reporting CVE-2016-7041. The CVE-2016-8608 issue was discovered by Kirill Gaevskii (Red Hat).
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update is now available for Red Hat JBoss BPM Suite.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "This release of Red Hat JBoss BPM Suite 6.4.0 serves as a replacement for Red Hat JBoss BPM Suite 6.3.4, and includes bug fixes and enhancements, which are documented in the Release Notes of the patch linked to in the References section.\n\nSecurity Fix(es):\n\n* It was found that several XML parsers used by XStream had default settings that would expand entity references. A remote, unauthenticated attacker could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks. (CVE-2016-3674)\n\n* Drools Workbench contains the path traversal vulnerability. The vulnerability allows a remote, authenticated attacker to bypass the directory restrictions and retrieve arbitrary files from the affected host. (CVE-2016-7041)\n\n* JBoss BRMS 6 and BPM Suite 6 are vulnerable to a stored XSS via business process editor. The flaw is due to an incomplete fix for CVE-2016-5398. Remote, authenticated attackers that have privileges to create business processes can store scripts in them, which are not properly sanitized before showing to other users, including admins. (CVE-2016-8608)\n\nRed Hat would like to thank Jonas Bauters (NVISO) for reporting CVE-2016-7041. The CVE-2016-8608 issue was discovered by Kirill Gaevskii (Red Hat).",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2016:2822",
"url": "https://access.redhat.com/errata/RHSA-2016:2822"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=bpm.suite\u0026downloadType=distributions\u0026version=6.4",
"url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=bpm.suite\u0026downloadType=distributions\u0026version=6.4"
},
{
"category": "external",
"summary": "1321789",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1321789"
},
{
"category": "external",
"summary": "1375757",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1375757"
},
{
"category": "external",
"summary": "1386806",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1386806"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_2822.json"
}
],
"title": "Red Hat Security Advisory: Red Hat JBoss BPM Suite security update",
"tracking": {
"current_release_date": "2025-11-21T17:58:43+00:00",
"generator": {
"date": "2025-11-21T17:58:43+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.12"
}
},
"id": "RHSA-2016:2822",
"initial_release_date": "2016-11-28T17:55:25+00:00",
"revision_history": [
{
"date": "2016-11-28T17:55:25+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2019-02-20T12:40:09+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2025-11-21T17:58:43+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat JBoss BPMS 6.3",
"product": {
"name": "Red Hat JBoss BPMS 6.3",
"product_id": "Red Hat JBoss BPMS 6.3",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:jboss_bpms:6.3"
}
}
}
],
"category": "product_family",
"name": "Red Hat Process Automation Manager"
}
],
"category": "vendor",
"name": "Red Hat"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2016-3674",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"discovery_date": "2016-03-25T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1321789"
}
],
"notes": [
{
"category": "description",
"text": "It was found that several XML parsers used by XStream had default settings that would expand entity references. A remote, unauthenticated attacker could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "XStream: enabled processing of external entities",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BPMS 6.3"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-3674"
},
{
"category": "external",
"summary": "RHBZ#1321789",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1321789"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-3674",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-3674"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-3674",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-3674"
},
{
"category": "external",
"summary": "https://github.com/x-stream/xstream/issues/25",
"url": "https://github.com/x-stream/xstream/issues/25"
}
],
"release_date": "2016-03-15T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-11-28T17:55:25+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application Server process before installing this update; after installing the update, restart the server by starting the JBoss Application Server process.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat JBoss BPMS 6.3"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:2822"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"products": [
"Red Hat JBoss BPMS 6.3"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "XStream: enabled processing of external entities"
},
{
"acknowledgments": [
{
"names": [
"Jonas Bauters"
],
"organization": "NVISO"
}
],
"cve": "CVE-2016-7041",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2016-06-26T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1375757"
}
],
"notes": [
{
"category": "description",
"text": "Drools Workbench contains the path traversal vulnerability. The vulnerability allows a remote, authenticated attacker to bypass the directory restrictions and retrieve arbitrary files from the affected host.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Workbench: Path traversal vulnerability",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BPMS 6.3"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-7041"
},
{
"category": "external",
"summary": "RHBZ#1375757",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1375757"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-7041",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-7041"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-7041",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-7041"
}
],
"release_date": "2016-11-28T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-11-28T17:55:25+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application Server process before installing this update; after installing the update, restart the server by starting the JBoss Application Server process.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat JBoss BPMS 6.3"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:2822"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:S/C:C/I:N/A:N",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
},
"products": [
"Red Hat JBoss BPMS 6.3"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Workbench: Path traversal vulnerability"
},
{
"acknowledgments": [
{
"names": [
"Kirill Gaevskii"
],
"organization": "Red Hat",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2016-8608",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2016-10-19T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1386806"
}
],
"notes": [
{
"category": "description",
"text": "JBoss BRMS 6 and BPM Suite 6 are vulnerable to a stored XSS via business process editor. The flaw is due to an incomplete fix for CVE-2016-5398. Remote, authenticated attackers that have privileges to create business processes can store scripts in them, which are not properly sanitized before showing to other users, including admins.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Stored XSS in business process editor",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BPMS 6.3"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-8608"
},
{
"category": "external",
"summary": "RHBZ#1386806",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1386806"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-8608",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-8608"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-8608",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-8608"
}
],
"release_date": "2016-11-28T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-11-28T17:55:25+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application Server process before installing this update; after installing the update, restart the server by starting the JBoss Application Server process.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat JBoss BPMS 6.3"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:2822"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:N",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"Red Hat JBoss BPMS 6.3"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Stored XSS in business process editor"
}
]
}
RHSA-2016_2822
Vulnerability from csaf_redhat - Published: 2016-11-28 17:55 - Updated: 2024-11-22 10:29Summary
Red Hat Security Advisory: Red Hat JBoss BPM Suite security update
Notes
Topic
An update is now available for Red Hat JBoss BPM Suite.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
This release of Red Hat JBoss BPM Suite 6.4.0 serves as a replacement for Red Hat JBoss BPM Suite 6.3.4, and includes bug fixes and enhancements, which are documented in the Release Notes of the patch linked to in the References section.
Security Fix(es):
* It was found that several XML parsers used by XStream had default settings that would expand entity references. A remote, unauthenticated attacker could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks. (CVE-2016-3674)
* Drools Workbench contains the path traversal vulnerability. The vulnerability allows a remote, authenticated attacker to bypass the directory restrictions and retrieve arbitrary files from the affected host. (CVE-2016-7041)
* JBoss BRMS 6 and BPM Suite 6 are vulnerable to a stored XSS via business process editor. The flaw is due to an incomplete fix for CVE-2016-5398. Remote, authenticated attackers that have privileges to create business processes can store scripts in them, which are not properly sanitized before showing to other users, including admins. (CVE-2016-8608)
Red Hat would like to thank Jonas Bauters (NVISO) for reporting CVE-2016-7041. The CVE-2016-8608 issue was discovered by Kirill Gaevskii (Red Hat).
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update is now available for Red Hat JBoss BPM Suite.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "This release of Red Hat JBoss BPM Suite 6.4.0 serves as a replacement for Red Hat JBoss BPM Suite 6.3.4, and includes bug fixes and enhancements, which are documented in the Release Notes of the patch linked to in the References section.\n\nSecurity Fix(es):\n\n* It was found that several XML parsers used by XStream had default settings that would expand entity references. A remote, unauthenticated attacker could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks. (CVE-2016-3674)\n\n* Drools Workbench contains the path traversal vulnerability. The vulnerability allows a remote, authenticated attacker to bypass the directory restrictions and retrieve arbitrary files from the affected host. (CVE-2016-7041)\n\n* JBoss BRMS 6 and BPM Suite 6 are vulnerable to a stored XSS via business process editor. The flaw is due to an incomplete fix for CVE-2016-5398. Remote, authenticated attackers that have privileges to create business processes can store scripts in them, which are not properly sanitized before showing to other users, including admins. (CVE-2016-8608)\n\nRed Hat would like to thank Jonas Bauters (NVISO) for reporting CVE-2016-7041. The CVE-2016-8608 issue was discovered by Kirill Gaevskii (Red Hat).",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2016:2822",
"url": "https://access.redhat.com/errata/RHSA-2016:2822"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=bpm.suite\u0026downloadType=distributions\u0026version=6.4",
"url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=bpm.suite\u0026downloadType=distributions\u0026version=6.4"
},
{
"category": "external",
"summary": "1321789",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1321789"
},
{
"category": "external",
"summary": "1375757",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1375757"
},
{
"category": "external",
"summary": "1386806",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1386806"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_2822.json"
}
],
"title": "Red Hat Security Advisory: Red Hat JBoss BPM Suite security update",
"tracking": {
"current_release_date": "2024-11-22T10:29:48+00:00",
"generator": {
"date": "2024-11-22T10:29:48+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2016:2822",
"initial_release_date": "2016-11-28T17:55:25+00:00",
"revision_history": [
{
"date": "2016-11-28T17:55:25+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2019-02-20T12:40:09+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-22T10:29:48+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat JBoss BPMS 6.3",
"product": {
"name": "Red Hat JBoss BPMS 6.3",
"product_id": "Red Hat JBoss BPMS 6.3",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:jboss_bpms:6.3"
}
}
}
],
"category": "product_family",
"name": "Red Hat Process Automation Manager"
}
],
"category": "vendor",
"name": "Red Hat"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2016-3674",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"discovery_date": "2016-03-25T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1321789"
}
],
"notes": [
{
"category": "description",
"text": "It was found that several XML parsers used by XStream had default settings that would expand entity references. A remote, unauthenticated attacker could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "XStream: enabled processing of external entities",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BPMS 6.3"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-3674"
},
{
"category": "external",
"summary": "RHBZ#1321789",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1321789"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-3674",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-3674"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-3674",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-3674"
},
{
"category": "external",
"summary": "https://github.com/x-stream/xstream/issues/25",
"url": "https://github.com/x-stream/xstream/issues/25"
}
],
"release_date": "2016-03-15T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-11-28T17:55:25+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application Server process before installing this update; after installing the update, restart the server by starting the JBoss Application Server process.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat JBoss BPMS 6.3"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:2822"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"products": [
"Red Hat JBoss BPMS 6.3"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "XStream: enabled processing of external entities"
},
{
"acknowledgments": [
{
"names": [
"Jonas Bauters"
],
"organization": "NVISO"
}
],
"cve": "CVE-2016-7041",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2016-06-26T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1375757"
}
],
"notes": [
{
"category": "description",
"text": "Drools Workbench contains the path traversal vulnerability. The vulnerability allows a remote, authenticated attacker to bypass the directory restrictions and retrieve arbitrary files from the affected host.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Workbench: Path traversal vulnerability",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BPMS 6.3"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-7041"
},
{
"category": "external",
"summary": "RHBZ#1375757",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1375757"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-7041",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-7041"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-7041",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-7041"
}
],
"release_date": "2016-11-28T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-11-28T17:55:25+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application Server process before installing this update; after installing the update, restart the server by starting the JBoss Application Server process.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat JBoss BPMS 6.3"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:2822"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:S/C:C/I:N/A:N",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
},
"products": [
"Red Hat JBoss BPMS 6.3"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Workbench: Path traversal vulnerability"
},
{
"acknowledgments": [
{
"names": [
"Kirill Gaevskii"
],
"organization": "Red Hat",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2016-8608",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2016-10-19T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1386806"
}
],
"notes": [
{
"category": "description",
"text": "JBoss BRMS 6 and BPM Suite 6 are vulnerable to a stored XSS via business process editor. The flaw is due to an incomplete fix for CVE-2016-5398. Remote, authenticated attackers that have privileges to create business processes can store scripts in them, which are not properly sanitized before showing to other users, including admins.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Stored XSS in business process editor",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss BPMS 6.3"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-8608"
},
{
"category": "external",
"summary": "RHBZ#1386806",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1386806"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-8608",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-8608"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-8608",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-8608"
}
],
"release_date": "2016-11-28T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-11-28T17:55:25+00:00",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application Server process before installing this update; after installing the update, restart the server by starting the JBoss Application Server process.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat JBoss BPMS 6.3"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:2822"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:N",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"Red Hat JBoss BPMS 6.3"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Stored XSS in business process editor"
}
]
}
FKIE_CVE-2016-3674
Vulnerability from fkie_nvd - Published: 2016-05-17 14:08 - Updated: 2025-05-23 17:54
Severity ?
Summary
Multiple XML external entity (XXE) vulnerabilities in the (1) Dom4JDriver, (2) DomDriver, (3) JDomDriver, (4) JDom2Driver, (5) SjsxpDriver, (6) StandardStaxDriver, and (7) WstxDriver drivers in XStream before 1.4.9 allow remote attackers to read arbitrary files via a crafted XML document.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| redhat | jboss_middleware | 1 | |
| debian | debian_linux | 8.0 | |
| fedoraproject | fedora | 22 | |
| fedoraproject | fedora | 23 | |
| xstream | xstream | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:redhat:jboss_middleware:1:*:*:*:*:*:*:*",
"matchCriteriaId": "1F4A0F87-524E-4935-9B07-93793D8143FD",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:22:*:*:*:*:*:*:*",
"matchCriteriaId": "253C303A-E577-4488-93E6-68A8DD942C38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:23:*:*:*:*:*:*:*",
"matchCriteriaId": "E79AB8DD-C907-4038-A931-1A5A4CFB6A5B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:xstream:xstream:*:*:*:*:*:*:*:*",
"matchCriteriaId": "78113271-8210-443B-AAB0-E923D14B8F74",
"versionEndExcluding": "1.4.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple XML external entity (XXE) vulnerabilities in the (1) Dom4JDriver, (2) DomDriver, (3) JDomDriver, (4) JDom2Driver, (5) SjsxpDriver, (6) StandardStaxDriver, and (7) WstxDriver drivers in XStream before 1.4.9 allow remote attackers to read arbitrary files via a crafted XML document."
},
{
"lang": "es",
"value": "M\u00faltiples vulnerabilidades de entidad externa (XXE) en (1) Dom4JDriver, (2) DomDriver, (3) JDom Driver, (4) JDom2Driver, (5) SjsxpDriver, (6) StandardStaxDriver y (7) WstxDriver drivers en XStream en versiones anteriores a 1.4.9 permiten a atacantes remotos leer archivos arbitrarios a trav\u00e9s de un documento XML manipulado."
}
],
"id": "CVE-2016-3674",
"lastModified": "2025-05-23T17:54:18.250",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2016-05-17T14:08:03.607",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"Broken Link"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183180.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"Broken Link"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183208.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Broken Link"
],
"url": "http://rhn.redhat.com/errata/RHSA-2016-2822.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Broken Link"
],
"url": "http://rhn.redhat.com/errata/RHSA-2016-2823.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://www.debian.org/security/2016/dsa-3575"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://www.openwall.com/lists/oss-security/2016/03/25/8"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://www.openwall.com/lists/oss-security/2016/03/28/1"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/85381"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securitytracker.com/id/1036419"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://x-stream.github.io/changes.html#1.4.9"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "https://github.com/x-stream/xstream/issues/25"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"Broken Link"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183180.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"Broken Link"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183208.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Broken Link"
],
"url": "http://rhn.redhat.com/errata/RHSA-2016-2822.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Broken Link"
],
"url": "http://rhn.redhat.com/errata/RHSA-2016-2823.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://www.debian.org/security/2016/dsa-3575"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://www.openwall.com/lists/oss-security/2016/03/25/8"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://www.openwall.com/lists/oss-security/2016/03/28/1"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/85381"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securitytracker.com/id/1036419"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://x-stream.github.io/changes.html#1.4.9"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://github.com/x-stream/xstream/issues/25"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-200"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
CNVD-2016-01922
Vulnerability from cnvd - Published: 2016-03-30
VLAI Severity ?
Title
XStream XML外部实体漏洞
Description
XStream是XStream团队开发的一个轻量级的、简单易用的开源Java类库，它主要用于将对象序列化成XML（JSON）或反序列化为对象。
XStream 1.4.9版本中存在XML外部实体漏洞，该漏洞源于程序中的解析器默认忽略外部实体。攻击者可利用该漏洞通过操纵XML访问文件系统中的数据。
Severity
中
Formal description
目前厂商暂未发布修复措施解决此安全问题，建议使用此软件的用户随时关注厂商主页或参考网址以获取解决办法： http://x-stream.github.io/index.html
Reference
http://www.openwall.com/lists/oss-security/2016/03/28/1
Impacted products
| Name | XStream XStream 1.4.9 |
|---|
{
"cves": {
"cve": {
"cveNumber": "CVE-2016-3674"
}
},
"description": "XStream\u662fXStream\u56e2\u961f\u5f00\u53d1\u7684\u4e00\u4e2a\u8f7b\u91cf\u7ea7\u7684\u3001\u7b80\u5355\u6613\u7528\u7684\u5f00\u6e90Java\u7c7b\u5e93\uff0c\u5b83\u4e3b\u8981\u7528\u4e8e\u5c06\u5bf9\u8c61\u5e8f\u5217\u5316\u6210XML\uff08JSON\uff09\u6216\u53cd\u5e8f\u5217\u5316\u4e3a\u5bf9\u8c61\u3002\r\n\r\nXStream 1.4.9\u7248\u672c\u4e2d\u5b58\u5728XML\u5916\u90e8\u5b9e\u4f53\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7a0b\u5e8f\u4e2d\u7684\u89e3\u6790\u5668\u9ed8\u8ba4\u5ffd\u7565\u5916\u90e8\u5b9e\u4f53\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u901a\u8fc7\u64cd\u7eb5XML\u8bbf\u95ee\u6587\u4ef6\u7cfb\u7edf\u4e2d\u7684\u6570\u636e\u3002",
"discovererName": "unknown",
"formalWay": "\u76ee\u524d\u5382\u5546\u6682\u672a\u53d1\u5e03\u4fee\u590d\u63aa\u65bd\u89e3\u51b3\u6b64\u5b89\u5168\u95ee\u9898\uff0c\u5efa\u8bae\u4f7f\u7528\u6b64\u8f6f\u4ef6\u7684\u7528\u6237\u968f\u65f6\u5173\u6ce8\u5382\u5546\u4e3b\u9875\u6216\u53c2\u8003\u7f51\u5740\u4ee5\u83b7\u53d6\u89e3\u51b3\u529e\u6cd5\uff1a\r\nhttp://x-stream.github.io/index.html",
"isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
"number": "CNVD-2016-01922",
"openTime": "2016-03-30",
"products": {
"product": "XStream XStream 1.4.9"
},
"referenceLink": "http://www.openwall.com/lists/oss-security/2016/03/28/1",
"serverity": "\u4e2d",
"submitTime": "2016-03-29",
"title": "XStream XML\u5916\u90e8\u5b9e\u4f53\u6f0f\u6d1e"
}
WID-SEC-W-2022-1375
Vulnerability from csaf_certbund - Published: 2022-09-11 22:00 - Updated: 2023-09-14 22:00Summary
JFrog Artifactory: Mehrere Schwachstellen
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung
JFrog Artifactory ist eine universelle DevOps-Lösung.
Angriff
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in JFrog Artifactory ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszulösen.
Betroffene Betriebssysteme
- UNIX
- Linux
{
"document": {
"aggregate_severity": {
"text": "hoch"
},
"category": "csaf_base",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "de-DE",
"notes": [
{
"category": "legal_disclaimer",
"text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
},
{
"category": "description",
"text": "JFrog Artifactory ist eine universelle DevOps-L\u00f6sung.",
"title": "Produktbeschreibung"
},
{
"category": "summary",
"text": "Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in JFrog Artifactory ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen.",
"title": "Angriff"
},
{
"category": "general",
"text": "- UNIX\n- Linux",
"title": "Betroffene Betriebssysteme"
}
],
"publisher": {
"category": "other",
"contact_details": "csaf-provider@cert-bund.de",
"name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
"namespace": "https://www.bsi.bund.de"
},
"references": [
{
"category": "self",
"summary": "WID-SEC-W-2022-1375 - CSAF Version",
"url": "https://wid.cert-bund.de/.well-known/csaf/white/2022/wid-sec-w-2022-1375.json"
},
{
"category": "self",
"summary": "WID-SEC-2022-1375 - Portal Version",
"url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1375"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2023:5165 vom 2023-09-14",
"url": "https://access.redhat.com/errata/RHSA-2023:5165"
},
{
"category": "external",
"summary": "JFrog Fixed Security Vulnerabilities vom 2022-09-11",
"url": "https://www.jfrog.com/confluence/display/JFROG/Fixed+Security+Vulnerabilities"
},
{
"category": "external",
"summary": "JFrog Fixed Security Vulnerabilities",
"url": "https://www.jfrog.com/confluence/display/JFROG/Fixed+Security+Vulnerabilities"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2022:6782 vom 2022-10-04",
"url": "https://access.redhat.com/errata/RHSA-2022:6782"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-5776-1 vom 2022-12-13",
"url": "https://ubuntu.com/security/notices/USN-5776-1"
}
],
"source_lang": "en-US",
"title": "JFrog Artifactory: Mehrere Schwachstellen",
"tracking": {
"current_release_date": "2023-09-14T22:00:00.000+00:00",
"generator": {
"date": "2024-08-15T17:34:59.214+00:00",
"engine": {
"name": "BSI-WID",
"version": "1.3.5"
}
},
"id": "WID-SEC-W-2022-1375",
"initial_release_date": "2022-09-11T22:00:00.000+00:00",
"revision_history": [
{
"date": "2022-09-11T22:00:00.000+00:00",
"number": "1",
"summary": "Initiale Fassung"
},
{
"date": "2022-10-03T22:00:00.000+00:00",
"number": "2",
"summary": "Neue Updates aufgenommen"
},
{
"date": "2022-10-04T22:00:00.000+00:00",
"number": "3",
"summary": "Neue Updates von Red Hat aufgenommen"
},
{
"date": "2022-12-12T23:00:00.000+00:00",
"number": "4",
"summary": "Neue Updates von Ubuntu aufgenommen"
},
{
"date": "2022-12-20T23:00:00.000+00:00",
"number": "5",
"summary": "Referenz(en) aufgenommen: FEDORA-2022-DB674BAFD9, FEDORA-2022-7E327A20BE"
},
{
"date": "2023-09-14T22:00:00.000+00:00",
"number": "6",
"summary": "Neue Updates von Red Hat aufgenommen"
}
],
"status": "final",
"version": "6"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "JFrog Artifactory",
"product": {
"name": "JFrog Artifactory",
"product_id": "T024527",
"product_identification_helper": {
"cpe": "cpe:/a:jfrog:artifactory:-"
}
}
},
{
"category": "product_name",
"name": "JFrog Artifactory \u003c 7.46.3",
"product": {
"name": "JFrog Artifactory \u003c 7.46.3",
"product_id": "T024764",
"product_identification_helper": {
"cpe": "cpe:/a:jfrog:artifactory:7.46.3"
}
}
}
],
"category": "product_name",
"name": "Artifactory"
}
],
"category": "vendor",
"name": "JFrog"
},
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux",
"product": {
"name": "Red Hat Enterprise Linux",
"product_id": "67646",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:-"
}
}
}
],
"category": "vendor",
"name": "Red Hat"
},
{
"branches": [
{
"category": "product_name",
"name": "Ubuntu Linux",
"product": {
"name": "Ubuntu Linux",
"product_id": "T000126",
"product_identification_helper": {
"cpe": "cpe:/o:canonical:ubuntu_linux:-"
}
}
}
],
"category": "vendor",
"name": "Ubuntu"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2013-4517",
"notes": [
{
"category": "description",
"text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
}
],
"product_status": {
"known_affected": [
"T024527",
"67646",
"T000126",
"T024764"
]
},
"release_date": "2022-09-11T22:00:00.000+00:00",
"title": "CVE-2013-4517"
},
{
"cve": "CVE-2013-7285",
"notes": [
{
"category": "description",
"text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
}
],
"product_status": {
"known_affected": [
"T024527",
"67646",
"T000126",
"T024764"
]
},
"release_date": "2022-09-11T22:00:00.000+00:00",
"title": "CVE-2013-7285"
},
{
"cve": "CVE-2014-0107",
"notes": [
{
"category": "description",
"text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
}
],
"product_status": {
"known_affected": [
"T024527",
"67646",
"T000126",
"T024764"
]
},
"release_date": "2022-09-11T22:00:00.000+00:00",
"title": "CVE-2014-0107"
},
{
"cve": "CVE-2014-0114",
"notes": [
{
"category": "description",
"text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
}
],
"product_status": {
"known_affected": [
"T024527",
"67646",
"T000126",
"T024764"
]
},
"release_date": "2022-09-11T22:00:00.000+00:00",
"title": "CVE-2014-0114"
},
{
"cve": "CVE-2014-3577",
"notes": [
{
"category": "description",
"text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
}
],
"product_status": {
"known_affected": [
"T024527",
"67646",
"T000126",
"T024764"
]
},
"release_date": "2022-09-11T22:00:00.000+00:00",
"title": "CVE-2014-3577"
},
{
"cve": "CVE-2014-3623",
"notes": [
{
"category": "description",
"text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
}
],
"product_status": {
"known_affected": [
"T024527",
"67646",
"T000126",
"T024764"
]
},
"release_date": "2022-09-11T22:00:00.000+00:00",
"title": "CVE-2014-3623"
},
{
"cve": "CVE-2015-0227",
"notes": [
{
"category": "description",
"text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
}
],
"product_status": {
"known_affected": [
"T024527",
"67646",
"T000126",
"T024764"
]
},
"release_date": "2022-09-11T22:00:00.000+00:00",
"title": "CVE-2015-0227"
},
{
"cve": "CVE-2015-2575",
"notes": [
{
"category": "description",
"text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
}
],
"product_status": {
"known_affected": [
"T024527",
"67646",
"T000126",
"T024764"
]
},
"release_date": "2022-09-11T22:00:00.000+00:00",
"title": "CVE-2015-2575"
},
{
"cve": "CVE-2015-3253",
"notes": [
{
"category": "description",
"text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
}
],
"product_status": {
"known_affected": [
"T024527",
"67646",
"T000126",
"T024764"
]
},
"release_date": "2022-09-11T22:00:00.000+00:00",
"title": "CVE-2015-3253"
},
{
"cve": "CVE-2015-4852",
"notes": [
{
"category": "description",
"text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
}
],
"product_status": {
"known_affected": [
"T024527",
"67646",
"T000126",
"T024764"
]
},
"release_date": "2022-09-11T22:00:00.000+00:00",
"title": "CVE-2015-4852"
},
{
"cve": "CVE-2015-7940",
"notes": [
{
"category": "description",
"text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
}
],
"product_status": {
"known_affected": [
"T024527",
"67646",
"T000126",
"T024764"
]
},
"release_date": "2022-09-11T22:00:00.000+00:00",
"title": "CVE-2015-7940"
},
{
"cve": "CVE-2016-10750",
"notes": [
{
"category": "description",
"text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
}
],
"product_status": {
"known_affected": [
"T024527",
"67646",
"T000126",
"T024764"
]
},
"release_date": "2022-09-11T22:00:00.000+00:00",
"title": "CVE-2016-10750"
},
{
"cve": "CVE-2016-3092",
"notes": [
{
"category": "description",
"text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
}
],
"product_status": {
"known_affected": [
"T024527",
"67646",
"T000126",
"T024764"
]
},
"release_date": "2022-09-11T22:00:00.000+00:00",
"title": "CVE-2016-3092"
},
{
"cve": "CVE-2016-3674",
"notes": [
{
"category": "description",
"text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
}
],
"product_status": {
"known_affected": [
"T024527",
"67646",
"T000126",
"T024764"
]
},
"release_date": "2022-09-11T22:00:00.000+00:00",
"title": "CVE-2016-3674"
},
{
"cve": "CVE-2016-6501",
"notes": [
{
"category": "description",
"text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
}
],
"product_status": {
"known_affected": [
"T024527",
"67646",
"T000126",
"T024764"
]
},
"release_date": "2022-09-11T22:00:00.000+00:00",
"title": "CVE-2016-6501"
},
{
"cve": "CVE-2016-8735",
"notes": [
{
"category": "description",
"text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
}
],
"product_status": {
"known_affected": [
"T024527",
"67646",
"T000126",
"T024764"
]
},
"release_date": "2022-09-11T22:00:00.000+00:00",
"title": "CVE-2016-8735"
},
{
"cve": "CVE-2016-8745",
"notes": [
{
"category": "description",
"text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
}
],
"product_status": {
"known_affected": [
"T024527",
"67646",
"T000126",
"T024764"
]
},
"release_date": "2022-09-11T22:00:00.000+00:00",
"title": "CVE-2016-8745"
},
{
"cve": "CVE-2017-1000487",
"notes": [
{
"category": "description",
"text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
}
],
"product_status": {
"known_affected": [
"T024527",
"67646",
"T000126",
"T024764"
]
},
"release_date": "2022-09-11T22:00:00.000+00:00",
"title": "CVE-2017-1000487"
},
{
"cve": "CVE-2017-15095",
"notes": [
{
"category": "description",
"text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
}
],
"product_status": {
"known_affected": [
"T024527",
"67646",
"T000126",
"T024764"
]
},
"release_date": "2022-09-11T22:00:00.000+00:00",
"title": "CVE-2017-15095"
},
{
"cve": "CVE-2017-17485",
"notes": [
{
"category": "description",
"text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
}
],
"product_status": {
"known_affected": [
"T024527",
"67646",
"T000126",
"T024764"
]
},
"release_date": "2022-09-11T22:00:00.000+00:00",
"title": "CVE-2017-17485"
},
{
"cve": "CVE-2017-18214",
"notes": [
{
"category": "description",
"text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
}
],
"product_status": {
"known_affected": [
"T024527",
"67646",
"T000126",
"T024764"
]
},
"release_date": "2022-09-11T22:00:00.000+00:00",
"title": "CVE-2017-18214"
},
{
"cve": "CVE-2017-18640",
"notes": [
{
"category": "description",
"text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
}
],
"product_status": {
"known_affected": [
"T024527",
"67646",
"T000126",
"T024764"
]
},
"release_date": "2022-09-11T22:00:00.000+00:00",
"title": "CVE-2017-18640"
},
{
"cve": "CVE-2017-7525",
"notes": [
{
"category": "description",
"text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
}
],
"product_status": {
"known_affected": [
"T024527",
"67646",
"T000126",
"T024764"
]
},
"release_date": "2022-09-11T22:00:00.000+00:00",
"title": "CVE-2017-7525"
},
{
"cve": "CVE-2017-7657",
"notes": [
{
"category": "description",
"text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
}
],
"product_status": {
"known_affected": [
"T024527",
"67646",
"T000126",
"T024764"
]
},
"release_date": "2022-09-11T22:00:00.000+00:00",
"title": "CVE-2017-7657"
},
{
"cve": "CVE-2017-7957",
"notes": [
{
"category": "description",
"text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
}
],
"product_status": {
"known_affected": [
"T024527",
"67646",
"T000126",
"T024764"
]
},
"release_date": "2022-09-11T22:00:00.000+00:00",
"title": "CVE-2017-7957"
},
{
"cve": "CVE-2017-9506",
"notes": [
{
"category": "description",
"text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
}
],
"product_status": {
"known_affected": [
"T024527",
"67646",
"T000126",
"T024764"
]
},
"release_date": "2022-09-11T22:00:00.000+00:00",
"title": "CVE-2017-9506"
},
{
"cve": "CVE-2018-1000206",
"notes": [
{
"category": "description",
"text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
}
],
"product_status": {
"known_affected": [
"T024527",
"67646",
"T000126",
"T024764"
]
},
"release_date": "2022-09-11T22:00:00.000+00:00",
"title": "CVE-2018-1000206"
},
{
"cve": "CVE-2018-9116",
"notes": [
{
"category": "description",
"text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
}
],
"product_status": {
"known_affected": [
"T024527",
"67646",
"T000126",
"T024764"
]
},
"release_date": "2022-09-11T22:00:00.000+00:00",
"title": "CVE-2018-9116"
},
{
"cve": "CVE-2019-10219",
"notes": [
{
"category": "description",
"text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
}
],
"product_status": {
"known_affected": [
"T024527",
"67646",
"T000126",
"T024764"
]
},
"release_date": "2022-09-11T22:00:00.000+00:00",
"title": "CVE-2019-10219"
},
{
"cve": "CVE-2019-12402",
"notes": [
{
"category": "description",
"text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
}
],
"product_status": {
"known_affected": [
"T024527",
"67646",
"T000126",
"T024764"
]
},
"release_date": "2022-09-11T22:00:00.000+00:00",
"title": "CVE-2019-12402"
},
{
"cve": "CVE-2019-17359",
"notes": [
{
"category": "description",
"text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
}
],
"product_status": {
"known_affected": [
"T024527",
"67646",
"T000126",
"T024764"
]
},
"release_date": "2022-09-11T22:00:00.000+00:00",
"title": "CVE-2019-17359"
},
{
"cve": "CVE-2019-17571",
"notes": [
{
"category": "description",
"text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
}
],
"product_status": {
"known_affected": [
"T024527",
"67646",
"T000126",
"T024764"
]
},
"release_date": "2022-09-11T22:00:00.000+00:00",
"title": "CVE-2019-17571"
},
{
"cve": "CVE-2019-20104",
"notes": [
{
"category": "description",
"text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
}
],
"product_status": {
"known_affected": [
"T024527",
"67646",
"T000126",
"T024764"
]
},
"release_date": "2022-09-11T22:00:00.000+00:00",
"title": "CVE-2019-20104"
},
{
"cve": "CVE-2020-11996",
"notes": [
{
"category": "description",
"text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
}
],
"product_status": {
"known_affected": [
"T024527",
"67646",
"T000126",
"T024764"
]
},
"release_date": "2022-09-11T22:00:00.000+00:00",
"title": "CVE-2020-11996"
},
{
"cve": "CVE-2020-13934",
"notes": [
{
"category": "description",
"text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
}
],
"product_status": {
"known_affected": [
"T024527",
"67646",
"T000126",
"T024764"
]
},
"release_date": "2022-09-11T22:00:00.000+00:00",
"title": "CVE-2020-13934"
},
{
"cve": "CVE-2020-13935",
"notes": [
{
"category": "description",
"text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
}
],
"product_status": {
"known_affected": [
"T024527",
"67646",
"T000126",
"T024764"
]
},
"release_date": "2022-09-11T22:00:00.000+00:00",
"title": "CVE-2020-13935"
},
{
"cve": "CVE-2020-13949",
"notes": [
{
"category": "description",
"text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
}
],
"product_status": {
"known_affected": [
"T024527",
"67646",
"T000126",
"T024764"
]
},
"release_date": "2022-09-11T22:00:00.000+00:00",
"title": "CVE-2020-13949"
},
{
"cve": "CVE-2020-14340",
"notes": [
{
"category": "description",
"text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
}
],
"product_status": {
"known_affected": [
"T024527",
"67646",
"T000126",
"T024764"
]
},
"release_date": "2022-09-11T22:00:00.000+00:00",
"title": "CVE-2020-14340"
},
{
"cve": "CVE-2020-15586",
"notes": [
{
"category": "description",
"text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
}
],
"product_status": {
"known_affected": [
"T024527",
"67646",
"T000126",
"T024764"
]
},
"release_date": "2022-09-11T22:00:00.000+00:00",
"title": "CVE-2020-15586"
},
{
"cve": "CVE-2020-1745",
"notes": [
{
"category": "description",
"text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
}
],
"product_status": {
"known_affected": [
"T024527",
"67646",
"T000126",
"T024764"
]
},
"release_date": "2022-09-11T22:00:00.000+00:00",
"title": "CVE-2020-1745"
},
{
"cve": "CVE-2020-17521",
"notes": [
{
"category": "description",
"text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
}
],
"product_status": {
"known_affected": [
"T024527",
"67646",
"T000126",
"T024764"
]
},
"release_date": "2022-09-11T22:00:00.000+00:00",
"title": "CVE-2020-17521"
},
{
"cve": "CVE-2020-25649",
"notes": [
{
"category": "description",
"text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
}
],
"product_status": {
"known_affected": [
"T024527",
"67646",
"T000126",
"T024764"
]
},
"release_date": "2022-09-11T22:00:00.000+00:00",
"title": "CVE-2020-25649"
},
{
"cve": "CVE-2020-28500",
"notes": [
{
"category": "description",
"text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
}
],
"product_status": {
"known_affected": [
"T024527",
"67646",
"T000126",
"T024764"
]
},
"release_date": "2022-09-11T22:00:00.000+00:00",
"title": "CVE-2020-28500"
},
{
"cve": "CVE-2020-29582",
"notes": [
{
"category": "description",
"text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
}
],
"product_status": {
"known_affected": [
"T024527",
"67646",
"T000126",
"T024764"
]
},
"release_date": "2022-09-11T22:00:00.000+00:00",
"title": "CVE-2020-29582"
},
{
"cve": "CVE-2020-36518",
"notes": [
{
"category": "description",
"text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
}
],
"product_status": {
"known_affected": [
"T024527",
"67646",
"T000126",
"T024764"
]
},
"release_date": "2022-09-11T22:00:00.000+00:00",
"title": "CVE-2020-36518"
},
{
"cve": "CVE-2020-7226",
"notes": [
{
"category": "description",
"text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
}
],
"product_status": {
"known_affected": [
"T024527",
"67646",
"T000126",
"T024764"
]
},
"release_date": "2022-09-11T22:00:00.000+00:00",
"title": "CVE-2020-7226"
},
{
"cve": "CVE-2020-7692",
"notes": [
{
"category": "description",
"text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
}
],
"product_status": {
"known_affected": [
"T024527",
"67646",
"T000126",
"T024764"
]
},
"release_date": "2022-09-11T22:00:00.000+00:00",
"title": "CVE-2020-7692"
},
{
"cve": "CVE-2020-8203",
"notes": [
{
"category": "description",
"text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
}
],
"product_status": {
"known_affected": [
"T024527",
"67646",
"T000126",
"T024764"
]
},
"release_date": "2022-09-11T22:00:00.000+00:00",
"title": "CVE-2020-8203"
},
{
"cve": "CVE-2021-13936",
"notes": [
{
"category": "description",
"text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
}
],
"product_status": {
"known_affected": [
"T024527",
"67646",
"T000126",
"T024764"
]
},
"release_date": "2022-09-11T22:00:00.000+00:00",
"title": "CVE-2021-13936"
},
{
"cve": "CVE-2021-21290",
"notes": [
{
"category": "description",
"text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
}
],
"product_status": {
"known_affected": [
"T024527",
"67646",
"T000126",
"T024764"
]
},
"release_date": "2022-09-11T22:00:00.000+00:00",
"title": "CVE-2021-21290"
},
{
"cve": "CVE-2021-22060",
"notes": [
{
"category": "description",
"text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
}
],
"product_status": {
"known_affected": [
"T024527",
"67646",
"T000126",
"T024764"
]
},
"release_date": "2022-09-11T22:00:00.000+00:00",
"title": "CVE-2021-22060"
},
{
"cve": "CVE-2021-22112",
"notes": [
{
"category": "description",
"text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
}
],
"product_status": {
"known_affected": [
"T024527",
"67646",
"T000126",
"T024764"
]
},
"release_date": "2022-09-11T22:00:00.000+00:00",
"title": "CVE-2021-22112"
},
{
"cve": "CVE-2021-22119",
"notes": [
{
"category": "description",
"text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
}
],
"product_status": {
"known_affected": [
"T024527",
"67646",
"T000126",
"T024764"
]
},
"release_date": "2022-09-11T22:00:00.000+00:00",
"title": "CVE-2021-22119"
},
{
"cve": "CVE-2021-22147",
"notes": [
{
"category": "description",
"text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
}
],
"product_status": {
"known_affected": [
"T024527",
"67646",
"T000126",
"T024764"
]
},
"release_date": "2022-09-11T22:00:00.000+00:00",
"title": "CVE-2021-22147"
},
{
"cve": "CVE-2021-22148",
"notes": [
{
"category": "description",
"text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
}
],
"product_status": {
"known_affected": [
"T024527",
"67646",
"T000126",
"T024764"
]
},
"release_date": "2022-09-11T22:00:00.000+00:00",
"title": "CVE-2021-22148"
},
{
"cve": "CVE-2021-22149",
"notes": [
{
"category": "description",
"text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
}
],
"product_status": {
"known_affected": [
"T024527",
"67646",
"T000126",
"T024764"
]
},
"release_date": "2022-09-11T22:00:00.000+00:00",
"title": "CVE-2021-22149"
},
{
"cve": "CVE-2021-22573",
"notes": [
{
"category": "description",
"text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
}
],
"product_status": {
"known_affected": [
"T024527",
"67646",
"T000126",
"T024764"
]
},
"release_date": "2022-09-11T22:00:00.000+00:00",
"title": "CVE-2021-22573"
},
{
"cve": "CVE-2021-23337",
"notes": [
{
"category": "description",
"text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
}
],
"product_status": {
"known_affected": [
"T024527",
"67646",
"T000126",
"T024764"
]
},
"release_date": "2022-09-11T22:00:00.000+00:00",
"title": "CVE-2021-23337"
},
{
"cve": "CVE-2021-25122",
"notes": [
{
"category": "description",
"text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
}
],
"product_status": {
"known_affected": [
"T024527",
"67646",
"T000126",
"T024764"
]
},
"release_date": "2022-09-11T22:00:00.000+00:00",
"title": "CVE-2021-25122"
},
{
"cve": "CVE-2021-26291",
"notes": [
{
"category": "description",
"text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
}
],
"product_status": {
"known_affected": [
"T024527",
"67646",
"T000126",
"T024764"
]
},
"release_date": "2022-09-11T22:00:00.000+00:00",
"title": "CVE-2021-26291"
},
{
"cve": "CVE-2021-27568",
"notes": [
{
"category": "description",
"text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
}
],
"product_status": {
"known_affected": [
"T024527",
"67646",
"T000126",
"T024764"
]
},
"release_date": "2022-09-11T22:00:00.000+00:00",
"title": "CVE-2021-27568"
},
{
"cve": "CVE-2021-29505",
"notes": [
{
"category": "description",
"text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
}
],
"product_status": {
"known_affected": [
"T024527",
"67646",
"T000126",
"T024764"
]
},
"release_date": "2022-09-11T22:00:00.000+00:00",
"title": "CVE-2021-29505"
},
{
"cve": "CVE-2021-30129",
"notes": [
{
"category": "description",
"text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
}
],
"product_status": {
"known_affected": [
"T024527",
"67646",
"T000126",
"T024764"
]
},
"release_date": "2022-09-11T22:00:00.000+00:00",
"title": "CVE-2021-30129"
},
{
"cve": "CVE-2021-33037",
"notes": [
{
"category": "description",
"text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
}
],
"product_status": {
"known_affected": [
"T024527",
"67646",
"T000126",
"T024764"
]
},
"release_date": "2022-09-11T22:00:00.000+00:00",
"title": "CVE-2021-33037"
},
{
"cve": "CVE-2021-35550",
"notes": [
{
"category": "description",
"text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
}
],
"product_status": {
"known_affected": [
"T024527",
"67646",
"T000126",
"T024764"
]
},
"release_date": "2022-09-11T22:00:00.000+00:00",
"title": "CVE-2021-35550"
},
{
"cve": "CVE-2021-35556",
"notes": [
{
"category": "description",
"text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
}
],
"product_status": {
"known_affected": [
"T024527",
"67646",
"T000126",
"T024764"
]
},
"release_date": "2022-09-11T22:00:00.000+00:00",
"title": "CVE-2021-35556"
},
{
"cve": "CVE-2021-35560",
"notes": [
{
"category": "description",
"text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
}
],
"product_status": {
"known_affected": [
"T024527",
"67646",
"T000126",
"T024764"
]
},
"release_date": "2022-09-11T22:00:00.000+00:00",
"title": "CVE-2021-35560"
},
{
"cve": "CVE-2021-35561",
"notes": [
{
"category": "description",
"text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
}
],
"product_status": {
"known_affected": [
"T024527",
"67646",
"T000126",
"T024764"
]
},
"release_date": "2022-09-11T22:00:00.000+00:00",
"title": "CVE-2021-35561"
},
{
"cve": "CVE-2021-35564",
"notes": [
{
"category": "description",
"text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
}
],
"product_status": {
"known_affected": [
"T024527",
"67646",
"T000126",
"T024764"
]
},
"release_date": "2022-09-11T22:00:00.000+00:00",
"title": "CVE-2021-35564"
},
{
"cve": "CVE-2021-35565",
"notes": [
{
"category": "description",
"text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
}
],
"product_status": {
"known_affected": [
"T024527",
"67646",
"T000126",
"T024764"
]
},
"release_date": "2022-09-11T22:00:00.000+00:00",
"title": "CVE-2021-35565"
},
{
"cve": "CVE-2021-35567",
"notes": [
{
"category": "description",
"text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
}
],
"product_status": {
"known_affected": [
"T024527",
"67646",
"T000126",
"T024764"
]
},
"release_date": "2022-09-11T22:00:00.000+00:00",
"title": "CVE-2021-35567"
},
{
"cve": "CVE-2021-35578",
"notes": [
{
"category": "description",
"text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
}
],
"product_status": {
"known_affected": [
"T024527",
"67646",
"T000126",
"T024764"
]
},
"release_date": "2022-09-11T22:00:00.000+00:00",
"title": "CVE-2021-35578"
},
{
"cve": "CVE-2021-35586",
"notes": [
{
"category": "description",
"text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
}
],
"product_status": {
"known_affected": [
"T024527",
"67646",
"T000126",
"T024764"
]
},
"release_date": "2022-09-11T22:00:00.000+00:00",
"title": "CVE-2021-35586"
},
{
"cve": "CVE-2021-35588",
"notes": [
{
"category": "description",
"text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
}
],
"product_status": {
"known_affected": [
"T024527",
"67646",
"T000126",
"T024764"
]
},
"release_date": "2022-09-11T22:00:00.000+00:00",
"title": "CVE-2021-35588"
},
{
"cve": "CVE-2021-35603",
"notes": [
{
"category": "description",
"text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
}
],
"product_status": {
"known_affected": [
"T024527",
"67646",
"T000126",
"T024764"
]
},
"release_date": "2022-09-11T22:00:00.000+00:00",
"title": "CVE-2021-35603"
},
{
"cve": "CVE-2021-36374",
"notes": [
{
"category": "description",
"text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
}
],
"product_status": {
"known_affected": [
"T024527",
"67646",
"T000126",
"T024764"
]
},
"release_date": "2022-09-11T22:00:00.000+00:00",
"title": "CVE-2021-36374"
},
{
"cve": "CVE-2021-3765",
"notes": [
{
"category": "description",
"text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
}
],
"product_status": {
"known_affected": [
"T024527",
"67646",
"T000126",
"T024764"
]
},
"release_date": "2022-09-11T22:00:00.000+00:00",
"title": "CVE-2021-3765"
},
{
"cve": "CVE-2021-3807",
"notes": [
{
"category": "description",
"text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
}
],
"product_status": {
"known_affected": [
"T024527",
"67646",
"T000126",
"T024764"
]
},
"release_date": "2022-09-11T22:00:00.000+00:00",
"title": "CVE-2021-3807"
},
{
"cve": "CVE-2021-38561",
"notes": [
{
"category": "description",
"text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
}
],
"product_status": {
"known_affected": [
"T024527",
"67646",
"T000126",
"T024764"
]
},
"release_date": "2022-09-11T22:00:00.000+00:00",
"title": "CVE-2021-38561"
},
{
"cve": "CVE-2021-3859",
"notes": [
{
"category": "description",
"text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
}
],
"product_status": {
"known_affected": [
"T024527",
"67646",
"T000126",
"T024764"
]
},
"release_date": "2022-09-11T22:00:00.000+00:00",
"title": "CVE-2021-3859"
},
{
"cve": "CVE-2021-41090",
"notes": [
{
"category": "description",
"text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
}
],
"product_status": {
"known_affected": [
"T024527",
"67646",
"T000126",
"T024764"
]
},
"release_date": "2022-09-11T22:00:00.000+00:00",
"title": "CVE-2021-41090"
},
{
"cve": "CVE-2021-41091",
"notes": [
{
"category": "description",
"text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
}
],
"product_status": {
"known_affected": [
"T024527",
"67646",
"T000126",
"T024764"
]
},
"release_date": "2022-09-11T22:00:00.000+00:00",
"title": "CVE-2021-41091"
},
{
"cve": "CVE-2021-42340",
"notes": [
{
"category": "description",
"text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
}
],
"product_status": {
"known_affected": [
"T024527",
"67646",
"T000126",
"T024764"
]
},
"release_date": "2022-09-11T22:00:00.000+00:00",
"title": "CVE-2021-42340"
},
{
"cve": "CVE-2021-42550",
"notes": [
{
"category": "description",
"text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
}
],
"product_status": {
"known_affected": [
"T024527",
"67646",
"T000126",
"T024764"
]
},
"release_date": "2022-09-11T22:00:00.000+00:00",
"title": "CVE-2021-42550"
},
{
"cve": "CVE-2021-43797",
"notes": [
{
"category": "description",
"text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
}
],
"product_status": {
"known_affected": [
"T024527",
"67646",
"T000126",
"T024764"
]
},
"release_date": "2022-09-11T22:00:00.000+00:00",
"title": "CVE-2021-43797"
},
{
"cve": "CVE-2022-0536",
"notes": [
{
"category": "description",
"text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
}
],
"product_status": {
"known_affected": [
"T024527",
"67646",
"T000126",
"T024764"
]
},
"release_date": "2022-09-11T22:00:00.000+00:00",
"title": "CVE-2022-0536"
},
{
"cve": "CVE-2022-22963",
"notes": [
{
"category": "description",
"text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
}
],
"product_status": {
"known_affected": [
"T024527",
"67646",
"T000126",
"T024764"
]
},
"release_date": "2022-09-11T22:00:00.000+00:00",
"title": "CVE-2022-22963"
},
{
"cve": "CVE-2022-23632",
"notes": [
{
"category": "description",
"text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
}
],
"product_status": {
"known_affected": [
"T024527",
"67646",
"T000126",
"T024764"
]
},
"release_date": "2022-09-11T22:00:00.000+00:00",
"title": "CVE-2022-23632"
},
{
"cve": "CVE-2022-23648",
"notes": [
{
"category": "description",
"text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
}
],
"product_status": {
"known_affected": [
"T024527",
"67646",
"T000126",
"T024764"
]
},
"release_date": "2022-09-11T22:00:00.000+00:00",
"title": "CVE-2022-23648"
},
{
"cve": "CVE-2022-23806",
"notes": [
{
"category": "description",
"text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
}
],
"product_status": {
"known_affected": [
"T024527",
"67646",
"T000126",
"T024764"
]
},
"release_date": "2022-09-11T22:00:00.000+00:00",
"title": "CVE-2022-23806"
},
{
"cve": "CVE-2022-24769",
"notes": [
{
"category": "description",
"text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
}
],
"product_status": {
"known_affected": [
"T024527",
"67646",
"T000126",
"T024764"
]
},
"release_date": "2022-09-11T22:00:00.000+00:00",
"title": "CVE-2022-24769"
},
{
"cve": "CVE-2022-24823",
"notes": [
{
"category": "description",
"text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
}
],
"product_status": {
"known_affected": [
"T024527",
"67646",
"T000126",
"T024764"
]
},
"release_date": "2022-09-11T22:00:00.000+00:00",
"title": "CVE-2022-24823"
},
{
"cve": "CVE-2022-27191",
"notes": [
{
"category": "description",
"text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
}
],
"product_status": {
"known_affected": [
"T024527",
"67646",
"T000126",
"T024764"
]
},
"release_date": "2022-09-11T22:00:00.000+00:00",
"title": "CVE-2022-27191"
},
{
"cve": "CVE-2022-29153",
"notes": [
{
"category": "description",
"text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
}
],
"product_status": {
"known_affected": [
"T024527",
"67646",
"T000126",
"T024764"
]
},
"release_date": "2022-09-11T22:00:00.000+00:00",
"title": "CVE-2022-29153"
},
{
"cve": "CVE-2022-32212",
"notes": [
{
"category": "description",
"text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
}
],
"product_status": {
"known_affected": [
"T024527",
"67646",
"T000126",
"T024764"
]
},
"release_date": "2022-09-11T22:00:00.000+00:00",
"title": "CVE-2022-32212"
},
{
"cve": "CVE-2022-32213",
"notes": [
{
"category": "description",
"text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
}
],
"product_status": {
"known_affected": [
"T024527",
"67646",
"T000126",
"T024764"
]
},
"release_date": "2022-09-11T22:00:00.000+00:00",
"title": "CVE-2022-32213"
},
{
"cve": "CVE-2022-32214",
"notes": [
{
"category": "description",
"text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
}
],
"product_status": {
"known_affected": [
"T024527",
"67646",
"T000126",
"T024764"
]
},
"release_date": "2022-09-11T22:00:00.000+00:00",
"title": "CVE-2022-32214"
},
{
"cve": "CVE-2022-32215",
"notes": [
{
"category": "description",
"text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
}
],
"product_status": {
"known_affected": [
"T024527",
"67646",
"T000126",
"T024764"
]
},
"release_date": "2022-09-11T22:00:00.000+00:00",
"title": "CVE-2022-32215"
},
{
"cve": "CVE-2022-32223",
"notes": [
{
"category": "description",
"text": "In JFrog Artifactory existieren Zahlreiche Schwachstellen in verschiedenen Komponenten von Drittanbietern. Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszul\u00f6sen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert eine Benutzerinteraktion und erh\u00f6hte Rechte."
}
],
"product_status": {
"known_affected": [
"T024527",
"67646",
"T000126",
"T024764"
]
},
"release_date": "2022-09-11T22:00:00.000+00:00",
"title": "CVE-2022-32223"
}
]
}
GSD-2016-3674
Vulnerability from gsd - Updated: 2023-12-13 01:21Details
Multiple XML external entity (XXE) vulnerabilities in the (1) Dom4JDriver, (2) DomDriver, (3) JDomDriver, (4) JDom2Driver, (5) SjsxpDriver, (6) StandardStaxDriver, and (7) WstxDriver drivers in XStream before 1.4.9 allow remote attackers to read arbitrary files via a crafted XML document.
Aliases
Aliases
{
"GSD": {
"alias": "CVE-2016-3674",
"description": "Multiple XML external entity (XXE) vulnerabilities in the (1) Dom4JDriver, (2) DomDriver, (3) JDomDriver, (4) JDom2Driver, (5) SjsxpDriver, (6) StandardStaxDriver, and (7) WstxDriver drivers in XStream before 1.4.9 allow remote attackers to read arbitrary files via a crafted XML document.",
"id": "GSD-2016-3674",
"references": [
"https://www.suse.com/security/cve/CVE-2016-3674.html",
"https://www.debian.org/security/2016/dsa-3575",
"https://access.redhat.com/errata/RHSA-2016:2823",
"https://access.redhat.com/errata/RHSA-2016:2822",
"https://advisories.mageia.org/CVE-2016-3674.html"
]
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"aliases": [
"CVE-2016-3674"
],
"details": "Multiple XML external entity (XXE) vulnerabilities in the (1) Dom4JDriver, (2) DomDriver, (3) JDomDriver, (4) JDom2Driver, (5) SjsxpDriver, (6) StandardStaxDriver, and (7) WstxDriver drivers in XStream before 1.4.9 allow remote attackers to read arbitrary files via a crafted XML document.",
"id": "GSD-2016-3674",
"modified": "2023-12-13T01:21:27.492326Z",
"schema_version": "1.4.0"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-3674",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple XML external entity (XXE) vulnerabilities in the (1) Dom4JDriver, (2) DomDriver, (3) JDomDriver, (4) JDom2Driver, (5) SjsxpDriver, (6) StandardStaxDriver, and (7) WstxDriver drivers in XStream before 1.4.9 allow remote attackers to read arbitrary files via a crafted XML document."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://x-stream.github.io/changes.html#1.4.9",
"refsource": "CONFIRM",
"url": "http://x-stream.github.io/changes.html#1.4.9"
},
{
"name": "FEDORA-2016-de909cc333",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183180.html"
},
{
"name": "DSA-3575",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2016/dsa-3575"
},
{
"name": "RHSA-2016:2822",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2016-2822.html"
},
{
"name": "85381",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/85381"
},
{
"name": "1036419",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id/1036419"
},
{
"name": "[oss-security] 20160328 Re: CVE request - XStream: XXE vulnerability",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2016/03/28/1"
},
{
"name": "RHSA-2016:2823",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2016-2823.html"
},
{
"name": "https://github.com/x-stream/xstream/issues/25",
"refsource": "CONFIRM",
"url": "https://github.com/x-stream/xstream/issues/25"
},
{
"name": "[oss-security] 20160325 CVE request - XStream: XXE vulnerability",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2016/03/25/8"
},
{
"name": "FEDORA-2016-250042b8a6",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183208.html"
}
]
}
},
"gitlab.com": {
"advisories": [
{
"affected_range": "(,1.4.9)",
"affected_versions": "All versions before 1.4.9",
"cvss_v2": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"cvss_v3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cwe_ids": [
"CWE-1035",
"CWE-200",
"CWE-937"
],
"date": "2021-09-22",
"description": "Multiple XML external entity (XXE) vulnerabilities in the (1) Dom4JDriver, (2) DomDriver, (3) JDomDriver, (4) JDom2Driver, (5) SjsxpDriver, (6) StandardStaxDriver, and (7) WstxDriver drivers in XStream before 1.4.9 allow remote attackers to read arbitrary files via a crafted XML document.",
"fixed_versions": [
"1.4.9"
],
"identifier": "CVE-2016-3674",
"identifiers": [
"GHSA-rgh3-987h-wpmw",
"CVE-2016-3674"
],
"not_impacted": "All versions starting from 1.4.9",
"package_slug": "maven/com.thoughtworks.xstream/xstream",
"pubdate": "2020-06-30",
"solution": "Upgrade to version 1.4.9 or above.",
"title": "Exposure of Sensitive Information to an Unauthorized Actor",
"urls": [
"https://nvd.nist.gov/vuln/detail/CVE-2016-3674",
"https://github.com/x-stream/xstream/issues/25",
"https://snyk.io/vuln/SNYK-JAVA-COMTHOUGHTWORKSXSTREAM-30385",
"http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183180.html",
"http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183208.html",
"http://rhn.redhat.com/errata/RHSA-2016-2822.html",
"http://rhn.redhat.com/errata/RHSA-2016-2823.html",
"http://www.debian.org/security/2016/dsa-3575",
"http://www.openwall.com/lists/oss-security/2016/03/25/8",
"http://www.openwall.com/lists/oss-security/2016/03/28/1",
"http://www.securityfocus.com/bid/85381",
"http://www.securitytracker.com/id/1036419",
"http://x-stream.github.io/changes.html#1.4.9",
"https://github.com/advisories/GHSA-rgh3-987h-wpmw"
],
"uuid": "d35a88cd-99ce-45a6-aa53-be89c483fe40"
}
]
},
"nvd.nist.gov": {
"configurations": {
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:22:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:23:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:xstream_project:xstream:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "1.4.8",
"vulnerable": true
}
],
"operator": "OR"
}
]
},
"cve": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-3674"
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "en",
"value": "Multiple XML external entity (XXE) vulnerabilities in the (1) Dom4JDriver, (2) DomDriver, (3) JDomDriver, (4) JDom2Driver, (5) SjsxpDriver, (6) StandardStaxDriver, and (7) WstxDriver drivers in XStream before 1.4.9 allow remote attackers to read arbitrary files via a crafted XML document."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "en",
"value": "CWE-200"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "[oss-security] 20160325 CVE request - XStream: XXE vulnerability",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://www.openwall.com/lists/oss-security/2016/03/25/8"
},
{
"name": "DSA-3575",
"refsource": "DEBIAN",
"tags": [
"Third Party Advisory"
],
"url": "http://www.debian.org/security/2016/dsa-3575"
},
{
"name": "http://x-stream.github.io/changes.html#1.4.9",
"refsource": "CONFIRM",
"tags": [
"Vendor Advisory"
],
"url": "http://x-stream.github.io/changes.html#1.4.9"
},
{
"name": "https://github.com/x-stream/xstream/issues/25",
"refsource": "CONFIRM",
"tags": [
"Vendor Advisory"
],
"url": "https://github.com/x-stream/xstream/issues/25"
},
{
"name": "[oss-security] 20160328 Re: CVE request - XStream: XXE vulnerability",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://www.openwall.com/lists/oss-security/2016/03/28/1"
},
{
"name": "85381",
"refsource": "BID",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/85381"
},
{
"name": "FEDORA-2016-250042b8a6",
"refsource": "FEDORA",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183208.html"
},
{
"name": "FEDORA-2016-de909cc333",
"refsource": "FEDORA",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183180.html"
},
{
"name": "1036419",
"refsource": "SECTRACK",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securitytracker.com/id/1036419"
},
{
"name": "RHSA-2016:2823",
"refsource": "REDHAT",
"tags": [
"Broken Link"
],
"url": "http://rhn.redhat.com/errata/RHSA-2016-2823.html"
},
{
"name": "RHSA-2016:2822",
"refsource": "REDHAT",
"tags": [
"Broken Link"
],
"url": "http://rhn.redhat.com/errata/RHSA-2016-2822.html"
}
]
}
},
"impact": {
"baseMetricV2": {
"cvssV2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"userInteractionRequired": false
},
"baseMetricV3": {
"cvssV3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6
}
},
"lastModifiedDate": "2018-03-26T18:47Z",
"publishedDate": "2016-05-17T14:08Z"
}
}
}
GHSA-RGH3-987H-WPMW
Vulnerability from github – Published: 2020-06-30 22:48 – Updated: 2025-05-23 19:00
VLAI?
Summary
XML External Entity Injection in XStream
Details
Multiple XML external entity (XXE) vulnerabilities in the (1) Dom4JDriver, (2) DomDriver, (3) JDomDriver, (4) JDom2Driver, (5) SjsxpDriver, (6) StandardStaxDriver, and (7) WstxDriver drivers in XStream before 1.4.9 allow remote attackers to read arbitrary files via a crafted XML document.
Severity ?
7.5 (High)
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "com.thoughtworks.xstream:xstream"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.4.9"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2016-3674"
],
"database_specific": {
"cwe_ids": [
"CWE-200"
],
"github_reviewed": true,
"github_reviewed_at": "2020-06-30T22:47:58Z",
"nvd_published_at": "2016-05-17T14:08:03Z",
"severity": "HIGH"
},
"details": "Multiple XML external entity (XXE) vulnerabilities in the (1) Dom4JDriver, (2) DomDriver, (3) JDomDriver, (4) JDom2Driver, (5) SjsxpDriver, (6) StandardStaxDriver, and (7) WstxDriver drivers in XStream before 1.4.9 allow remote attackers to read arbitrary files via a crafted XML document.",
"id": "GHSA-rgh3-987h-wpmw",
"modified": "2025-05-23T19:00:03Z",
"published": "2020-06-30T22:48:14Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-3674"
},
{
"type": "WEB",
"url": "https://github.com/x-stream/xstream/issues/25"
},
{
"type": "PACKAGE",
"url": "https://github.com/x-stream/xstream"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-JAVA-COMTHOUGHTWORKSXSTREAM-30385"
},
{
"type": "WEB",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183180.html"
},
{
"type": "WEB",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183208.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2016-2822.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2016-2823.html"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2016/dsa-3575"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2016/03/25/8"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2016/03/28/1"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/85381"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1036419"
},
{
"type": "WEB",
"url": "http://x-stream.github.io/changes.html#1.4.9"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "XML External Entity Injection in XStream"
}
OPENSUSE-SU-2024:10592-1
Vulnerability from csaf_opensuse - Published: 2024-06-15 00:00 - Updated: 2024-06-15 00:00Summary
xstream-1.4.18-1.1 on GA media
Notes
Title of the patch
xstream-1.4.18-1.1 on GA media
Description of the patch
These are all security issues fixed in the xstream-1.4.18-1.1 package on the GA media of openSUSE Tumbleweed.
Patchnames
openSUSE-Tumbleweed-2024-10592
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "xstream-1.4.18-1.1 on GA media",
"title": "Title of the patch"
},
{
"category": "description",
"text": "These are all security issues fixed in the xstream-1.4.18-1.1 package on the GA media of openSUSE Tumbleweed.",
"title": "Description of the patch"
},
{
"category": "details",
"text": "openSUSE-Tumbleweed-2024-10592",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_10592-1.json"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-3674 page",
"url": "https://www.suse.com/security/cve/CVE-2016-3674/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-7957 page",
"url": "https://www.suse.com/security/cve/CVE-2017-7957/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-26217 page",
"url": "https://www.suse.com/security/cve/CVE-2020-26217/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-26258 page",
"url": "https://www.suse.com/security/cve/CVE-2020-26258/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-26259 page",
"url": "https://www.suse.com/security/cve/CVE-2020-26259/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-21341 page",
"url": "https://www.suse.com/security/cve/CVE-2021-21341/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-21342 page",
"url": "https://www.suse.com/security/cve/CVE-2021-21342/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-21343 page",
"url": "https://www.suse.com/security/cve/CVE-2021-21343/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-21344 page",
"url": "https://www.suse.com/security/cve/CVE-2021-21344/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-21345 page",
"url": "https://www.suse.com/security/cve/CVE-2021-21345/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-21346 page",
"url": "https://www.suse.com/security/cve/CVE-2021-21346/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-21347 page",
"url": "https://www.suse.com/security/cve/CVE-2021-21347/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-21348 page",
"url": "https://www.suse.com/security/cve/CVE-2021-21348/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-21349 page",
"url": "https://www.suse.com/security/cve/CVE-2021-21349/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-21350 page",
"url": "https://www.suse.com/security/cve/CVE-2021-21350/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-21351 page",
"url": "https://www.suse.com/security/cve/CVE-2021-21351/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-29505 page",
"url": "https://www.suse.com/security/cve/CVE-2021-29505/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-39139 page",
"url": "https://www.suse.com/security/cve/CVE-2021-39139/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-39144 page",
"url": "https://www.suse.com/security/cve/CVE-2021-39144/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-39147 page",
"url": "https://www.suse.com/security/cve/CVE-2021-39147/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-39150 page",
"url": "https://www.suse.com/security/cve/CVE-2021-39150/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-39153 page",
"url": "https://www.suse.com/security/cve/CVE-2021-39153/"
}
],
"title": "xstream-1.4.18-1.1 on GA media",
"tracking": {
"current_release_date": "2024-06-15T00:00:00Z",
"generator": {
"date": "2024-06-15T00:00:00Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "openSUSE-SU-2024:10592-1",
"initial_release_date": "2024-06-15T00:00:00Z",
"revision_history": [
{
"date": "2024-06-15T00:00:00Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "xstream-1.4.18-1.1.aarch64",
"product": {
"name": "xstream-1.4.18-1.1.aarch64",
"product_id": "xstream-1.4.18-1.1.aarch64"
}
},
{
"category": "product_version",
"name": "xstream-benchmark-1.4.18-1.1.aarch64",
"product": {
"name": "xstream-benchmark-1.4.18-1.1.aarch64",
"product_id": "xstream-benchmark-1.4.18-1.1.aarch64"
}
},
{
"category": "product_version",
"name": "xstream-javadoc-1.4.18-1.1.aarch64",
"product": {
"name": "xstream-javadoc-1.4.18-1.1.aarch64",
"product_id": "xstream-javadoc-1.4.18-1.1.aarch64"
}
},
{
"category": "product_version",
"name": "xstream-parent-1.4.18-1.1.aarch64",
"product": {
"name": "xstream-parent-1.4.18-1.1.aarch64",
"product_id": "xstream-parent-1.4.18-1.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "xstream-1.4.18-1.1.ppc64le",
"product": {
"name": "xstream-1.4.18-1.1.ppc64le",
"product_id": "xstream-1.4.18-1.1.ppc64le"
}
},
{
"category": "product_version",
"name": "xstream-benchmark-1.4.18-1.1.ppc64le",
"product": {
"name": "xstream-benchmark-1.4.18-1.1.ppc64le",
"product_id": "xstream-benchmark-1.4.18-1.1.ppc64le"
}
},
{
"category": "product_version",
"name": "xstream-javadoc-1.4.18-1.1.ppc64le",
"product": {
"name": "xstream-javadoc-1.4.18-1.1.ppc64le",
"product_id": "xstream-javadoc-1.4.18-1.1.ppc64le"
}
},
{
"category": "product_version",
"name": "xstream-parent-1.4.18-1.1.ppc64le",
"product": {
"name": "xstream-parent-1.4.18-1.1.ppc64le",
"product_id": "xstream-parent-1.4.18-1.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "xstream-1.4.18-1.1.s390x",
"product": {
"name": "xstream-1.4.18-1.1.s390x",
"product_id": "xstream-1.4.18-1.1.s390x"
}
},
{
"category": "product_version",
"name": "xstream-benchmark-1.4.18-1.1.s390x",
"product": {
"name": "xstream-benchmark-1.4.18-1.1.s390x",
"product_id": "xstream-benchmark-1.4.18-1.1.s390x"
}
},
{
"category": "product_version",
"name": "xstream-javadoc-1.4.18-1.1.s390x",
"product": {
"name": "xstream-javadoc-1.4.18-1.1.s390x",
"product_id": "xstream-javadoc-1.4.18-1.1.s390x"
}
},
{
"category": "product_version",
"name": "xstream-parent-1.4.18-1.1.s390x",
"product": {
"name": "xstream-parent-1.4.18-1.1.s390x",
"product_id": "xstream-parent-1.4.18-1.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "xstream-1.4.18-1.1.x86_64",
"product": {
"name": "xstream-1.4.18-1.1.x86_64",
"product_id": "xstream-1.4.18-1.1.x86_64"
}
},
{
"category": "product_version",
"name": "xstream-benchmark-1.4.18-1.1.x86_64",
"product": {
"name": "xstream-benchmark-1.4.18-1.1.x86_64",
"product_id": "xstream-benchmark-1.4.18-1.1.x86_64"
}
},
{
"category": "product_version",
"name": "xstream-javadoc-1.4.18-1.1.x86_64",
"product": {
"name": "xstream-javadoc-1.4.18-1.1.x86_64",
"product_id": "xstream-javadoc-1.4.18-1.1.x86_64"
}
},
{
"category": "product_version",
"name": "xstream-parent-1.4.18-1.1.x86_64",
"product": {
"name": "xstream-parent-1.4.18-1.1.x86_64",
"product_id": "xstream-parent-1.4.18-1.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "openSUSE Tumbleweed",
"product": {
"name": "openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:tumbleweed"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "xstream-1.4.18-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64"
},
"product_reference": "xstream-1.4.18-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xstream-1.4.18-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le"
},
"product_reference": "xstream-1.4.18-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xstream-1.4.18-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x"
},
"product_reference": "xstream-1.4.18-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xstream-1.4.18-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64"
},
"product_reference": "xstream-1.4.18-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xstream-benchmark-1.4.18-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64"
},
"product_reference": "xstream-benchmark-1.4.18-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xstream-benchmark-1.4.18-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le"
},
"product_reference": "xstream-benchmark-1.4.18-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xstream-benchmark-1.4.18-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x"
},
"product_reference": "xstream-benchmark-1.4.18-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xstream-benchmark-1.4.18-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64"
},
"product_reference": "xstream-benchmark-1.4.18-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xstream-javadoc-1.4.18-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64"
},
"product_reference": "xstream-javadoc-1.4.18-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xstream-javadoc-1.4.18-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le"
},
"product_reference": "xstream-javadoc-1.4.18-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xstream-javadoc-1.4.18-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x"
},
"product_reference": "xstream-javadoc-1.4.18-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xstream-javadoc-1.4.18-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64"
},
"product_reference": "xstream-javadoc-1.4.18-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xstream-parent-1.4.18-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64"
},
"product_reference": "xstream-parent-1.4.18-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xstream-parent-1.4.18-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le"
},
"product_reference": "xstream-parent-1.4.18-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xstream-parent-1.4.18-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x"
},
"product_reference": "xstream-parent-1.4.18-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "xstream-parent-1.4.18-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64"
},
"product_reference": "xstream-parent-1.4.18-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2016-3674",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-3674"
}
],
"notes": [
{
"category": "general",
"text": "Multiple XML external entity (XXE) vulnerabilities in the (1) Dom4JDriver, (2) DomDriver, (3) JDomDriver, (4) JDom2Driver, (5) SjsxpDriver, (6) StandardStaxDriver, and (7) WstxDriver drivers in XStream before 1.4.9 allow remote attackers to read arbitrary files via a crafted XML document.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-3674",
"url": "https://www.suse.com/security/cve/CVE-2016-3674"
},
{
"category": "external",
"summary": "SUSE Bug 972950 for CVE-2016-3674",
"url": "https://bugzilla.suse.com/972950"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2016-3674"
},
{
"cve": "CVE-2017-7957",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-7957"
}
],
"notes": [
{
"category": "general",
"text": "XStream through 1.4.9, when a certain denyTypes workaround is not used, mishandles attempts to create an instance of the primitive type \u0027void\u0027 during unmarshalling, leading to a remote application crash, as demonstrated by an xstream.fromXML(\"\u003cvoid/\u003e\") call.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-7957",
"url": "https://www.suse.com/security/cve/CVE-2017-7957"
},
{
"category": "external",
"summary": "SUSE Bug 1070731 for CVE-2017-7957",
"url": "https://bugzilla.suse.com/1070731"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2017-7957"
},
{
"cve": "CVE-2020-26217",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-26217"
}
],
"notes": [
{
"category": "general",
"text": "XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream. Only users who rely on blocklists are affected. Anyone using XStream\u0027s Security Framework allowlist is not affected. The linked advisory provides code workarounds for users who cannot upgrade. The issue is fixed in version 1.4.14.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-26217",
"url": "https://www.suse.com/security/cve/CVE-2020-26217"
},
{
"category": "external",
"summary": "SUSE Bug 1180994 for CVE-2020-26217",
"url": "https://bugzilla.suse.com/1180994"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2020-26217"
},
{
"cve": "CVE-2020-26258",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-26258"
}
],
"notes": [
{
"category": "general",
"text": "XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, a Server-Side Forgery Request vulnerability can be activated when unmarshalling. The vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream. If you rely on XStream\u0027s default blacklist of the Security Framework, you will have to use at least version 1.4.15. The reported vulnerability does not exist if running Java 15 or higher. No user is affected who followed the recommendation to setup XStream\u0027s Security Framework with a whitelist! Anyone relying on XStream\u0027s default blacklist can immediately switch to a whilelist for the allowed types to avoid the vulnerability. Users of XStream 1.4.14 or below who still want to use XStream default blacklist can use a workaround described in more detailed in the referenced advisories.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-26258",
"url": "https://www.suse.com/security/cve/CVE-2020-26258"
},
{
"category": "external",
"summary": "SUSE Bug 1180146 for CVE-2020-26258",
"url": "https://bugzilla.suse.com/1180146"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2020-26258"
},
{
"cve": "CVE-2020-26259",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-26259"
}
],
"notes": [
{
"category": "general",
"text": "XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling. The vulnerability may allow a remote attacker to delete arbitrary know files on the host as log as the executing process has sufficient rights only by manipulating the processed input stream. If you rely on XStream\u0027s default blacklist of the Security Framework, you will have to use at least version 1.4.15. The reported vulnerability does not exist running Java 15 or higher. No user is affected, who followed the recommendation to setup XStream\u0027s Security Framework with a whitelist! Anyone relying on XStream\u0027s default blacklist can immediately switch to a whilelist for the allowed types to avoid the vulnerability. Users of XStream 1.4.14 or below who still want to use XStream default blacklist can use a workaround described in more detailed in the referenced advisories.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-26259",
"url": "https://www.suse.com/security/cve/CVE-2020-26259"
},
{
"category": "external",
"summary": "SUSE Bug 1180145 for CVE-2020-26259",
"url": "https://bugzilla.suse.com/1180145"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2020-26259"
},
{
"cve": "CVE-2021-21341",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-21341"
}
],
"notes": [
{
"category": "general",
"text": "XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is vulnerability which may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a payload resulting in a denial of service only by manipulating the processed input stream. No user is affected who followed the recommendation to setup XStream\u0027s security framework with a whitelist limited to the minimal required types. If you rely on XStream\u0027s default blacklist of the Security Framework, you will have to use at least version 1.4.16.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-21341",
"url": "https://www.suse.com/security/cve/CVE-2021-21341"
},
{
"category": "external",
"summary": "SUSE Bug 1184377 for CVE-2021-21341",
"url": "https://bugzilla.suse.com/1184377"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2021-21341"
},
{
"cve": "CVE-2021-21342",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-21342"
}
],
"notes": [
{
"category": "general",
"text": "XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability where the processed stream at unmarshalling time contains type information to recreate the formerly written objects. XStream creates therefore new instances based on these type information. An attacker can manipulate the processed input stream and replace or inject objects, that result in a server-side forgery request. No user is affected, who followed the recommendation to setup XStream\u0027s security framework with a whitelist limited to the minimal required types. If you rely on XStream\u0027s default blacklist of the Security Framework, you will have to use at least version 1.4.16.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-21342",
"url": "https://www.suse.com/security/cve/CVE-2021-21342"
},
{
"category": "external",
"summary": "SUSE Bug 1184379 for CVE-2021-21342",
"url": "https://bugzilla.suse.com/1184379"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2021-21342"
},
{
"cve": "CVE-2021-21343",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-21343"
}
],
"notes": [
{
"category": "general",
"text": "XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability where the processed stream at unmarshalling time contains type information to recreate the formerly written objects. XStream creates therefore new instances based on these type information. An attacker can manipulate the processed input stream and replace or inject objects, that result in the deletion of a file on the local host. No user is affected, who followed the recommendation to setup XStream\u0027s security framework with a whitelist limited to the minimal required types. If you rely on XStream\u0027s default blacklist of the Security Framework, you will have to use at least version 1.4.16.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-21343",
"url": "https://www.suse.com/security/cve/CVE-2021-21343"
},
{
"category": "external",
"summary": "SUSE Bug 1184376 for CVE-2021-21343",
"url": "https://bugzilla.suse.com/1184376"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2021-21343"
},
{
"cve": "CVE-2021-21344",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-21344"
}
],
"notes": [
{
"category": "general",
"text": "XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream\u0027s security framework with a whitelist limited to the minimal required types. If you rely on XStream\u0027s default blacklist of the Security Framework, you will have to use at least version 1.4.16.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-21344",
"url": "https://www.suse.com/security/cve/CVE-2021-21344"
},
{
"category": "external",
"summary": "SUSE Bug 1184375 for CVE-2021-21344",
"url": "https://bugzilla.suse.com/1184375"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2021-21344"
},
{
"cve": "CVE-2021-21345",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-21345"
}
],
"notes": [
{
"category": "general",
"text": "XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker who has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream\u0027s security framework with a whitelist limited to the minimal required types. If you rely on XStream\u0027s default blacklist of the Security Framework, you will have to use at least version 1.4.16.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-21345",
"url": "https://www.suse.com/security/cve/CVE-2021-21345"
},
{
"category": "external",
"summary": "SUSE Bug 1184372 for CVE-2021-21345",
"url": "https://bugzilla.suse.com/1184372"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2021-21345"
},
{
"cve": "CVE-2021-21346",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-21346"
}
],
"notes": [
{
"category": "general",
"text": "XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream\u0027s security framework with a whitelist limited to the minimal required types. If you rely on XStream\u0027s default blacklist of the Security Framework, you will have to use at least version 1.4.16.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-21346",
"url": "https://www.suse.com/security/cve/CVE-2021-21346"
},
{
"category": "external",
"summary": "SUSE Bug 1184373 for CVE-2021-21346",
"url": "https://bugzilla.suse.com/1184373"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2021-21346"
},
{
"cve": "CVE-2021-21347",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-21347"
}
],
"notes": [
{
"category": "general",
"text": "XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream\u0027s security framework with a whitelist limited to the minimal required types. If you rely on XStream\u0027s default blacklist of the Security Framework, you will have to use at least version 1.4.16.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-21347",
"url": "https://www.suse.com/security/cve/CVE-2021-21347"
},
{
"category": "external",
"summary": "SUSE Bug 1184378 for CVE-2021-21347",
"url": "https://bugzilla.suse.com/1184378"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2021-21347"
},
{
"cve": "CVE-2021-21348",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-21348"
}
],
"notes": [
{
"category": "general",
"text": "XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to occupy a thread that consumes maximum CPU time and will never return. No user is affected, who followed the recommendation to setup XStream\u0027s security framework with a whitelist limited to the minimal required types. If you rely on XStream\u0027s default blacklist of the Security Framework, you will have to use at least version 1.4.16.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-21348",
"url": "https://www.suse.com/security/cve/CVE-2021-21348"
},
{
"category": "external",
"summary": "SUSE Bug 1184374 for CVE-2021-21348",
"url": "https://bugzilla.suse.com/1184374"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2021-21348"
},
{
"cve": "CVE-2021-21349",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-21349"
}
],
"notes": [
{
"category": "general",
"text": "XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream\u0027s security framework with a whitelist limited to the minimal required types. If you rely on XStream\u0027s default blacklist of the Security Framework, you will have to use at least version 1.4.16.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-21349",
"url": "https://www.suse.com/security/cve/CVE-2021-21349"
},
{
"category": "external",
"summary": "SUSE Bug 1184797 for CVE-2021-21349",
"url": "https://bugzilla.suse.com/1184797"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2021-21349"
},
{
"cve": "CVE-2021-21350",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-21350"
}
],
"notes": [
{
"category": "general",
"text": "XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to execute arbitrary code only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream\u0027s security framework with a whitelist limited to the minimal required types. If you rely on XStream\u0027s default blacklist of the Security Framework, you will have to use at least version 1.4.16.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-21350",
"url": "https://www.suse.com/security/cve/CVE-2021-21350"
},
{
"category": "external",
"summary": "SUSE Bug 1184380 for CVE-2021-21350",
"url": "https://bugzilla.suse.com/1184380"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2021-21350"
},
{
"cve": "CVE-2021-21351",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-21351"
}
],
"notes": [
{
"category": "general",
"text": "XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream\u0027s security framework with a whitelist limited to the minimal required types. If you rely on XStream\u0027s default blacklist of the Security Framework, you will have to use at least version 1.4.16.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-21351",
"url": "https://www.suse.com/security/cve/CVE-2021-21351"
},
{
"category": "external",
"summary": "SUSE Bug 1184796 for CVE-2021-21351",
"url": "https://bugzilla.suse.com/1184796"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2021-21351"
},
{
"cve": "CVE-2021-29505",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-29505"
}
],
"notes": [
{
"category": "general",
"text": "XStream is software for serializing Java objects to XML and back again. A vulnerability in XStream versions prior to 1.4.17 may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user who followed the recommendation to setup XStream\u0027s security framework with a whitelist limited to the minimal required types is affected. The vulnerability is patched in version 1.4.17.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-29505",
"url": "https://www.suse.com/security/cve/CVE-2021-29505"
},
{
"category": "external",
"summary": "SUSE Bug 1186651 for CVE-2021-29505",
"url": "https://bugzilla.suse.com/1186651"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2021-29505"
},
{
"cve": "CVE-2021-39139",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-39139"
}
],
"notes": [
{
"category": "general",
"text": "XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. A user is only affected if using the version out of the box with JDK 1.7u21 or below. However, this scenario can be adjusted easily to an external Xalan that works regardless of the version of the Java runtime. No user is affected, who followed the recommendation to setup XStream\u0027s security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-39139",
"url": "https://www.suse.com/security/cve/CVE-2021-39139"
},
{
"category": "external",
"summary": "SUSE Bug 1189798 for CVE-2021-39139",
"url": "https://bugzilla.suse.com/1189798"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2021-39139"
},
{
"cve": "CVE-2021-39144",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-39144"
}
],
"notes": [
{
"category": "general",
"text": "XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream\u0027s security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-39144",
"url": "https://www.suse.com/security/cve/CVE-2021-39144"
},
{
"category": "external",
"summary": "SUSE Bug 1189798 for CVE-2021-39144",
"url": "https://bugzilla.suse.com/1189798"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2021-39144"
},
{
"cve": "CVE-2021-39147",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-39147"
}
],
"notes": [
{
"category": "general",
"text": "XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream\u0027s security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-39147",
"url": "https://www.suse.com/security/cve/CVE-2021-39147"
},
{
"category": "external",
"summary": "SUSE Bug 1189798 for CVE-2021-39147",
"url": "https://bugzilla.suse.com/1189798"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2021-39147"
},
{
"cve": "CVE-2021-39150",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-39150"
}
],
"notes": [
{
"category": "general",
"text": "XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream with a Java runtime version 14 to 8. No user is affected, who followed the recommendation to setup XStream\u0027s security framework with a whitelist limited to the minimal required types. If you rely on XStream\u0027s default blacklist of the [Security Framework](https://x-stream.github.io/security.html#framework), you will have to use at least version 1.4.18.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-39150",
"url": "https://www.suse.com/security/cve/CVE-2021-39150"
},
{
"category": "external",
"summary": "SUSE Bug 1189798 for CVE-2021-39150",
"url": "https://bugzilla.suse.com/1189798"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2021-39150"
},
{
"cve": "CVE-2021-39153",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-39153"
}
],
"notes": [
{
"category": "general",
"text": "XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream, if using the version out of the box with Java runtime version 14 to 8 or with JavaFX installed. No user is affected, who followed the recommendation to setup XStream\u0027s security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-39153",
"url": "https://www.suse.com/security/cve/CVE-2021-39153"
},
{
"category": "external",
"summary": "SUSE Bug 1189798 for CVE-2021-39153",
"url": "https://bugzilla.suse.com/1189798"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
"openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2021-39153"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…