PT-2019-2961 · Xstream · Xstream

Published 2019-06-21 · Updated 2025-05-14 · CVE-2019-10173

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions XStream versions 1.4.10 through 1.4.10

Description The issue is related to a regression of a previous deserialization flaw in the XStream API. If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when unmarshalling XML or any supported format, such as JSON. This could be exploited by a remote attacker to execute arbitrary commands.

Recommendations For XStream version 1.4.10, update to version 1.4.11 to resolve the issue. As a temporary workaround, consider initializing the security framework before using the XStream API to minimize the risk of exploitation. Restrict access to unmarshalling XML or other supported formats until the issue is resolved.

Fix

Code Injection

Deserialization of Untrusted Data

Weakness Enumeration

CWE-94

CWE-502

Related Identifiers

BDU:2019-02936

CVE-2019-10173

GHSA-HF23-9PF7-388P

Affected Products

Xstream

References · 25

• https://osv.dev/vulnerability/GHSA-hf23-9pf7-388p · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-10173 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2019:3892 · Vendor Advisory
• https://oracle.com/security-alerts/cpuApr2021.html · Patch
• https://access.redhat.com/errata/RHSA-2020:0727 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-10173 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2020:0445 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-10173 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2019:4352 · Vendor Advisory
• https://oracle.com//security-alerts/cpujul2021.html · Patch
• https://ubuntu.com/security/CVE-2019-10173 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-10173 · Security Note
• https://bdu.fstec.ru/vul/2019-02936 · Security Note
• https://cve.org/CVERecord?id=CVE-2019-10173 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-10173 · Vendor Advisory