Executive Summary

Titlelibxmlrpc3-java security update
NameDSA-4619First vendor Publication2020-02-06
VendorDebianLast vendor Modification2020-02-06
Severity (Vendor) N/ARevision1

Security-Database Scoring CVSS v2

Cvss vector :
Cvss Base ScoreN/AAttack RangeN/A
Cvss Impact ScoreN/AAttack ComplexityN/A
Cvss Expoit ScoreN/AAuthenticationN/A
Calculate full CVSS 2.0 Vectors scores


Guillaume Teissier reported that the XMLRPC client in libxmlrpc3-java, an XML-RPC implementation in Java, does perform deserialization of the server-side exception serialized in the faultCause attribute of XMLRPC error response messages. A malicious XMLRPC server can take advantage of this flaw to execute arbitrary code with the privileges of an application using the Apache XMLRPC client library.

Note that a client that expects to get server-side exceptions need to set explicitly the enabledForExceptions property.

For the oldstable distribution (stretch), this problem has been fixed in version 3.1.3-8+deb9u1.

For the stable distribution (buster), this problem has been fixed in version 3.1.3-9+deb10u1.

We recommend that you upgrade your libxmlrpc3-java packages.

For the detailed security status of libxmlrpc3-java please refer to its security tracker page at: https://security-tracker.debian.org/tracker/libxmlrpc3-java

Original Source

Url : http://www.debian.org/security/2020/dsa-4619

Alert History

If you want to see full details history, please login or register.
2020-02-07 00:17:53
  • First insertion