CVE-2019-10173
published 2019-07-23CVE-2019-10173: It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw. If the security framework has not been…
PriorityP277critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
94.77%
99.8th percentile
It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw. If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when unmarshalling XML or any supported format. e.g. JSON. (regression of CVE-2013-7285)
Affected
25 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | libxstream-java | < libxstream-java 1.4.11-1 (bookworm) | libxstream-java 1.4.11-1 (bookworm) |
| oracle | banking_platform | — | — |
| oracle | banking_platform | — | — |
| oracle | banking_platform | — | — |
| oracle | banking_platform | 2.4.0 – 2.10.0 | — |
| oracle | business_activity_monitoring | — | — |
| oracle | business_activity_monitoring | — | — |
| oracle | business_activity_monitoring | — | — |
| oracle | communications_billing_and_revenue_management_elastic_charging_engine | — | — |
| oracle | communications_billing_and_revenue_management_elastic_charging_engine | — | — |
| oracle | communications_diameter_signaling_router | 8.0.0 – 8.2.2 | — |
| oracle | communications_unified_inventory_management | — | — |
| oracle | communications_unified_inventory_management | — | — |
| oracle | endeca_information_discovery_studio | — | — |
| oracle | endeca_information_discovery_studio | — | — |
| oracle | retail_xstore_point_of_service | — | — |
| oracle | utilities_framework | — | — |
| oracle | utilities_framework | — | — |
| oracle | utilities_framework | — | — |
| oracle | utilities_framework | — | — |
| oracle | utilities_framework | 4.3.0.1.0 – 4.3.0.6.0 | — |
| oracle | webcenter_portal | — | — |
| oracle | webcenter_portal | — | — |
| oracle | webcenter_portal | — | — |
| xstream | xstream | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Vulnerable version of xstream API is 1.4.10; exploitation requires the security framework to NOT have been initialized before unmarshalling XML or JSON input ↗
- →Attack vector is manipulation of the processed input stream during XML/JSON unmarshalling — monitor for unexpected process spawning (e.g. shell commands) from Java deserialization entry points handling XStream payloads ↗
- →This is a regression of CVE-2013-7285; detection rules and signatures written for CVE-2013-7285 XStream RCE payloads are directly applicable ↗
- ·Exploitation is only possible when the XStream security framework has NOT been initialized; applications that properly initialize the security framework are not vulnerable even on version 1.4.10 ↗
- ·The vulnerability was introduced specifically in xstream version 1.4.10 and is fixed in 1.4.11; only deployments running exactly 1.4.10 are affected by this regression ↗
- ·The fix changelog is available at http://x-stream.github.io/changes.html#1.4.11 — upgrading to 1.4.11 or later resolves the regression ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv3.07.3HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
ghsa9.8CRITICAL
osv9.8CRITICAL
vendor_debian9.8CRITICAL
vendor_oracle9.8CRITICAL
vendor_redhat9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Oracle
Oracle Oracle Fusion Middleware Risk Matrix: General (Xstream) — CVE-2019-10173
vendor_oracle·2021-01-15·CVSS 9.8
CVE-2019-10173 [CRITICAL] Oracle Oracle Fusion Middleware Risk Matrix: General (Xstream) — CVE-2019-10173
Oracle Oracle Fusion Middleware Risk Matrix: General (Xstream) vulnerability
CVE: CVE-2019-10173
CVSS: 9.8
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpujan2021 (JAN 2021)
Oracle
Oracle Oracle Communications Applications Risk Matrix: Diameter Gateway and SDK (xstream) — CVE-2019-10173
vendor_oracle·2020-10-15·CVSS 9.8
CVE-2019-10173 [CRITICAL] Oracle Oracle Communications Applications Risk Matrix: Diameter Gateway and SDK (xstream) — CVE-2019-10173
Oracle Oracle Communications Applications Risk Matrix: Diameter Gateway and SDK (xstream) vulnerability
CVE: CVE-2019-10173
CVSS: 9.8
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpuoct2020 (OCT 2020)
Oracle
Oracle Oracle Retail Applications Risk Matrix: Point of Sale (xstream) — CVE-2019-10173
vendor_oracle·2020-04-15·CVSS 3.9
CVE-2019-10173 [CRITICAL] Oracle Oracle Retail Applications Risk Matrix: Point of Sale (xstream) — CVE-2019-10173
Oracle Oracle Retail Applications Risk Matrix: Point of Sale (xstream) vulnerability
CVE: CVE-2019-10173
CVSS: 3.9
Protocol: HTTP
Remote exploit: No
Affected versions: Network
Advisory: cpuapr2020 (APR 2020)
Debian
CVE-2019-10173: libxstream-java - It was found that xstream API version 1.4.10 before 1.4.11 introduced a regressi...
vendor_debian·2019·CVSS 9.8
CVE-2019-10173 [CRITICAL] CVE-2019-10173: libxstream-java - It was found that xstream API version 1.4.10 before 1.4.11 introduced a regressi...
It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw. If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when unmarshalling XML or any supported format. e.g. JSON. (regression of CVE-2013-7285)
Scope: local
bookworm: resolved (fixed in 1.4.11-1)
bullseye: resolved (fixed in 1.4.11-1)
forky: resolved (fixed in 1.4.11-1)
sid: resolved (fixed in 1.4.11-1)
trixie: resolved (fixed in 1.4.11-1)
Red Hat
xstream: remote code execution due to insecure XML deserialization (regression of CVE-2013-7285)
vendor_redhat·2018-10-23·CVSS 9.8
CVE-2019-10173 [CRITICAL] CWE-94 xstream: remote code execution due to insecure XML deserialization (regression of CVE-2013-7285)
xstream: remote code execution due to insecure XML deserialization (regression of CVE-2013-7285)
It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw. If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when unmarshalling XML or any supported format. e.g. JSON. (regression of CVE-2013-7285)
It was found that xstream API version 1.4.10 introduced a regression for a previous deserialization flaw. If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when unmarshalling XML or any supported format. This a regression of CVE-2013-7285 fixed in 1.4.7 (fixed) as of BPMS 6.0.1, the regression was introduced wi
GHSA
Deserialization of Untrusted Data and Code Injection in xstream
ghsa·2019-07-26·CVSS 9.8
CVE-2019-10173 [CRITICAL] CWE-502 Deserialization of Untrusted Data and Code Injection in xstream
Deserialization of Untrusted Data and Code Injection in xstream
It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw. If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when unmarshalling XML or any supported format. e.g. JSON. (regression of CVE-2013-7285)
OSV
Deserialization of Untrusted Data and Code Injection in xstream
osv·2019-07-26·CVSS 9.8
CVE-2019-10173 [CRITICAL] Deserialization of Untrusted Data and Code Injection in xstream
Deserialization of Untrusted Data and Code Injection in xstream
It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw. If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when unmarshalling XML or any supported format. e.g. JSON. (regression of CVE-2013-7285)
OSV
CVE-2019-10173: It was found that xstream API version 1
osv·2019-07-23·CVSS 9.8
CVE-2019-10173 [CRITICAL] CVE-2019-10173: It was found that xstream API version 1
It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw. If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when unmarshalling XML or any supported format. e.g. JSON. (regression of CVE-2013-7285)
No detection rules found.
No public exploits indexed.
http://x-stream.github.io/changes.html#1.4.11https://access.redhat.com/errata/RHSA-2019:3892https://access.redhat.com/errata/RHSA-2019:4352https://access.redhat.com/errata/RHSA-2020:0445https://access.redhat.com/errata/RHSA-2020:0727https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10173https://www.oracle.com//security-alerts/cpujul2021.htmlhttps://www.oracle.com/security-alerts/cpuApr2021.htmlhttps://www.oracle.com/security-alerts/cpuapr2020.htmlhttps://www.oracle.com/security-alerts/cpujan2021.htmlhttps://www.oracle.com/security-alerts/cpuoct2020.htmlhttp://x-stream.github.io/changes.html#1.4.11https://access.redhat.com/errata/RHSA-2019:3892https://access.redhat.com/errata/RHSA-2019:4352https://access.redhat.com/errata/RHSA-2020:0445https://access.redhat.com/errata/RHSA-2020:0727https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10173https://www.oracle.com//security-alerts/cpujul2021.htmlhttps://www.oracle.com/security-alerts/cpuApr2021.htmlhttps://www.oracle.com/security-alerts/cpuapr2020.htmlhttps://www.oracle.com/security-alerts/cpujan2021.htmlhttps://www.oracle.com/security-alerts/cpuoct2020.html
2019-07-23
Published