CVE编号
CVE-2020-26217利用情况
POC 已公开补丁情况
官方补丁披露时间
2020-11-17漏洞描述
XStream是XStream团队的一个轻量级的、简单易用的开源Java类库，它主要用于将对象序列化成XML（JSON）或反序列化为对象。 XStream 1.4.14之前版本存在安全漏洞，该漏洞源于容易受到远程代码执行的攻击。攻击者可利用该漏洞仅通过操纵已处理的输入流来运行任意shell命令。只有依赖黑名单的用户才会受到影响。解决建议
目前厂商已发布升级补丁以修复漏洞，补丁获取链接：https://x-stream.github.io/CVE-2020-26217.html
参考链接 |
|
|---|---|
| https://github.com/x-stream/xstream/commit/0fec095d534126931c99fd38e9c6d41f5c685c1a | |
| https://github.com/x-stream/xstream/security/advisories/GHSA-mw36-7c6c-q4q2 | |
| https://lists.apache.org/thread.html/r2de526726e7f4db4a7cb91b7355070779f51a84... | |
| https://lists.apache.org/thread.html/r7c9fc255edc0b9cd9567093d131f6d33fde4c66... | |
| https://lists.apache.org/thread.html/r826a006fda71cc96fc87b6eca4b5d195f19a292... | |
| https://lists.apache.org/thread.html/redde3609b89b2a4ff18b536a06ef9a77deb93d4... | |
| https://lists.debian.org/debian-lts-announce/2020/12/msg00001.html | |
| https://security.netapp.com/advisory/ntap-20210409-0004/ | |
| https://www.debian.org/security/2020/dsa-4811 | |
| https://www.oracle.com//security-alerts/cpujul2021.html | |
| https://www.oracle.com/security-alerts/cpuApr2021.html | |
| https://www.oracle.com/security-alerts/cpujan2022.html | |
| https://www.oracle.com/security-alerts/cpuoct2021.html | |
| https://x-stream.github.io/CVE-2020-26217.html |
受影响软件情况
| # | 类型 | 厂商 | 产品 | 版本 | 影响面 | ||||
| 1 | |||||||||
|---|---|---|---|---|---|---|---|---|---|
| 运行在以下环境 | |||||||||
| 应用 | xstream_project | xstream | * |
Up to (excluding) 1.4.14 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | amazon_2 | xstream | * |
Up to (excluding) 1.3.1-12.amzn2 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | centos_7 | xstream | * |
Up to (excluding) 1.3.1-12.el7_9 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | debian_10 | xstream | * |
Up to (excluding) 1.4.11.1-1+deb10u1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | debian_9 | xstream | * |
Up to (excluding) 1.4.9-2+deb9u1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | opensuse_Leap_15.2 | xstream | * |
Up to (excluding) 1.4.15-lp152.2.3.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | oracle_7 | xstream | * |
Up to (excluding) 1.3.1-12.el7_9 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | ubuntu_18.04 | xstream | * |
Up to (excluding) 1.4.11.1-1~18.04.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | ubuntu_20.04 | xstream | * |
Up to (excluding) 1.4.11.1-1ubuntu0.1 |
|||||
- 攻击路径 远程
- 攻击复杂度 容易
- 权限要求 普通权限
- 影响范围 全局影响
- EXP成熟度 POC 已公开
- 补丁情况 官方补丁
- 数据保密性 数据泄露
- 数据完整性 无影响
- 服务器危害 无影响
- 全网数量 10000
还没有评论，来说两句吧...