[Geoserver-devel] [JIRA] (GEOS-9307) Geoserver is using a version of Xstream that has known vulnerabilities

[Mark Prins (JIRA)]

Title: Message Title

Mark Prins created an issue   GeoServer / GEOS-9307 Geoserver is using a version of Xstream that has known vulnerabilities Issue Type: Improvement Affects Versions: 2.15.2, 2.16-RC, 2.15.3, 2.16.0 Assignee: Unassigned Created: 21/Aug/19 1:09 PM Priority: High Reporter: Mark Prins Geoserver is using a version of Xstream that has known vulnerabilities, not sure if this makes GeoServer vulnerable or not, but upgrading is easy enough. CVE-2013-7285 Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. e.g. JSON. CVE-2019-10173 It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw. If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when unmarshalling XML or any supported format. e.g. JSON. (regression of CVE-2013-7285) Add Comment   Get Jira notifications on your phone! Download the Jira Cloud app for Android or iOS This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100107-sha1:e5f982f)

_______________________________________________
Geoserver-devel mailing list
Geoserver-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/geoserver-devel