Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.0
Apache XStream Vulnerability Affects Red Hat Products
published 2 years ago
Summary
A security issue was found in Apache XStream, used by Red Hat products, allowing an attacker to execute arbitrary code. This affects Red Hat products that use Apache XStream. Users should update their software to the latest version to prevent potential attacks.
What to do
- Update redhat xstream to version 0:1.3.1-12.el7_9.
- Update redhat xstream-javadoc to version 0:1.3.1-12.el7_9.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Red Hat:enterprise_linux:7::client | redhat | xstream |
< 0:1.3.1-12.el7_9 Fix: upgrade to 0:1.3.1-12.el7_9
|
| Red Hat:enterprise_linux:7::client | redhat | xstream-javadoc |
< 0:1.3.1-12.el7_9 Fix: upgrade to 0:1.3.1-12.el7_9
|
| Red Hat:enterprise_linux:7::computenode | redhat | xstream |
< 0:1.3.1-12.el7_9 Fix: upgrade to 0:1.3.1-12.el7_9
|
| Red Hat:enterprise_linux:7::computenode | redhat | xstream-javadoc |
< 0:1.3.1-12.el7_9 Fix: upgrade to 0:1.3.1-12.el7_9
|
| Red Hat:enterprise_linux:7::server | redhat | xstream |
< 0:1.3.1-12.el7_9 Fix: upgrade to 0:1.3.1-12.el7_9
|
| Red Hat:enterprise_linux:7::server | redhat | xstream-javadoc |
< 0:1.3.1-12.el7_9 Fix: upgrade to 0:1.3.1-12.el7_9
|
| Red Hat:enterprise_linux:7::workstation | redhat | xstream |
< 0:1.3.1-12.el7_9 Fix: upgrade to 0:1.3.1-12.el7_9
|
| Red Hat:enterprise_linux:7::workstation | redhat | xstream-javadoc |
< 0:1.3.1-12.el7_9 Fix: upgrade to 0:1.3.1-12.el7_9
|
Original advisory text
Red Hat Security Advisory: xstream security update
References
- https://access.redhat.com/errata/RHSA-2021:0162 Vendor Advisory
- https://access.redhat.com/security/updates/classification/#important Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1898907 Third Party Advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0162.j... Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2020-26217 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2020-26217 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2020-26217 Vendor Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Timeline
Published16 Sep 2024
Updated30 Apr 2026
First seen30 Apr 2026
Sources
RHSA-2021:0162 · OSV
Track software like this
Free during beta