Deserialization of Untrusted Data and Code Injection in xstream

Also known as GHSA-hf23-9pf7-388p

Published 7 y ago 2019-07-23 · modified 58 d ago 2026-09-10 · JSON

CVSS

7.3

v3.0 · CNA

CISA KEV

not known exploited

EPSS

95.0%

percentile 100%

Public exploits

none known

It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw. If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when unmarshalling XML or any supported format. e.g. JSON. (regression of CVE-2013-7285)

Exploit prediction (EPSS)

95.04% probability of exploitation in the next 30 days, higher than 100% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
CNA	3.0	7.3	`CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L`
NVD	3.1	9.8	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`
CNA	3.0	7.3	`CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L`
NVD	2.0	7.5	`AV:N/AC:L/Au:N/C:P/I:P/A:P`
GitHub	3.1	9.8	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`

Affected packages

Ecosystem	Package	Affected	Fixed in
maven	`com.thoughtworks.xstream:xstream`	>=1.4.10, <1.4.11	1.4.11

Affected products

xstream xstream

Classification

Weakness

CWE-94 Improper Control of Generation of Code
CWE-502 Deserialization of Untrusted Data

References

access.redhat.com /errata/RHSA-2019:3892 · vendor-advisory, x_refsource_REDHAT, x_transferred
access.redhat.com /errata/RHSA-2019:4352 · vendor-advisory, x_refsource_REDHAT, x_transferred
access.redhat.com /errata/RHSA-2020:0445 · vendor-advisory, x_refsource_REDHAT, x_transferred
access.redhat.com /errata/RHSA-2020:0727 · vendor-advisory, x_refsource_REDHAT, x_transferred
oracle.com /security-alerts/cpuapr2020.html · x_refsource_MISC, x_transferred
oracle.com /security-alerts/cpuoct2020.html · x_refsource_MISC, x_transferred
bugzilla.redhat.com /show_bug.cgi?id=CVE-2019-10173 · x_refsource_CONFIRM, x_transferred
x-stream.github.io /changes.html#1.4.11 · x_refsource_MISC, x_transferred
oracle.com /security-alerts/cpujan2021.html · x_refsource_MISC, x_transferred
oracle.com /security-alerts/cpuApr2021.html · x_refsource_MISC, x_transferred
oracle.com //security-alerts/cpujul2021.html · x_refsource_MISC, x_transferred
nvd.nist.gov /vuln/detail/CVE-2019-10173 · advisory
github.com /x-stream/xstream · package

Sources

CVE List: CVE-2019-10173
GitHub Advisory: GHSA-hf23-9pf7-388p
NVD: CVE-2019-10173

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary