CVE-2020-26258

Impact

The vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream.

Patches

If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.15.

Workarounds

The reported vulnerability does not exist running Java 15 or higher.

No user is affected, who followed the recommendation to setup XStream's Security Framework with a whitelist! Anyone relying on XStream's default blacklist can immediately switch to a whilelist for the allowed types to avoid the vulnerability.

Users of XStream 1.4.14 or below who still insist to use XStream default blacklist - despite that clear recommendation - can use a workaround depending on their version in use.

Users of XStream 1.4.14 can simply add two lines to XStream's setup code:

xstream.denyTypes(new String[]{ "jdk.nashorn.internal.objects.NativeString" });
xstream.denyTypesByRegExp(new String[]{ ".*\\.ReadAllStream\\$FileStream" });

Users of XStream 1.4.14 to 1.4.13 can simply add three lines to XStream's setup code:

xstream.denyTypes(new String[]{ "javax.imageio.ImageIO$ContainsFilter", "jdk.nashorn.internal.objects.NativeString" });
xstream.denyTypes(new Class[]{ java.lang.ProcessBuilder.class });
xstream.denyTypesByRegExp(new String[]{ ".*\\.ReadAllStream\\$FileStream" });

Users of XStream 1.4.12 to 1.4.7 who want to use XStream with a black list will have to setup such a list from scratch and deny at least the following types: javax.imageio.ImageIO$ContainsFilter, java.beans.EventHandler, java.lang.ProcessBuilder, jdk.nashorn.internal.objects.NativeString.class, java.lang.Void and void and deny several types by name pattern.

xstream.denyTypes(new String[]{ "javax.imageio.ImageIO$ContainsFilter", "jdk.nashorn.internal.objects.NativeString" });
xstream.denyTypes(new Class[]{ java.lang.ProcessBuilder.class, "jdk.nashorn.internal.objects.NativeString", java.beans.EventHandler.class, java.lang.ProcessBuilder.class, java.lang.Void.class, void.class });
xstream.denyTypesByRegExp(new String[]{ ".*\\$LazyIterator", "javax\\.crypto\\..*", ".*\\.ReadAllStream\\$FileStream" });

Users of XStream 1.4.6 or below can register an own converter to prevent the unmarshalling of the currently know critical types of the Java runtime. It is in fact an updated version of the workaround for CVE-2013-7285:

xstream.registerConverter(new Converter() {
  public boolean canConvert(Class type) {
    return type != null && (type == java.beans.EventHandler.class || type == java.lang.ProcessBuilder.class
        || type.getName().equals("javax.imageio.ImageIO$ContainsFilter") || type.getName().equals("jdk.nashorn.internal.objects.NativeString")
        || type == java.lang.Void.class || void.class || Proxy.isProxy(type))
        || type.getName().startsWith("javax.crypto.") || type.getName().endsWith("$LazyIterator") || type.getName().endsWith(".ReadAllStream$FileStream"));
  }

  public Object unmarshal(HierarchicalStreamReader reader, UnmarshallingContext context) {
    throw new ConversionException("Unsupported type due to security reasons.");
  }

  public void marshal(Object source, HierarchicalStreamWriter writer, MarshallingContext context) {
    throw new ConversionException("Unsupported type due to security reasons.");
  }
}, XStream.PRIORITY_LOW);

For more information

If you have any questions or comments about this advisory:

• Open an issue in XStream
• Contact us at XStream Google Group

XStream is a simple library to serialize objects to XML and back again. A high level facade is supplied that simplifies common use cases. Custom objects can be serialized without need for specifying mappings. Speed and low memory footprint are a crucial part of the design, making it suitable for large object graphs or systems with high message throughput. No information is duplicated that can be obtained via reflection. This results in XML that is easier to read for humans and more compact than native Java serialization. XStream serializes internal fields, including private and final. Supports non-public and inner classes. Classes are not required to have default constructor. Duplicate references encountered in the object-model will be maintained. Supports circular references. By implementing an interface, XStream can serialize directly to/from any tree structure (not just XML). Strategies can be registered allowing customization of how particular types are represented as XML. When an exception occurs due to malformed XML, detailed diagnostics are provided to help isolate and fix the problem.\r\n\r\n Security Fix(es):\r\n\r\n XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, a Server-Side Forgery Request vulnerability can be activated when unmarshalling. The vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.15. The reported vulnerability does not exist if running Java 15 or higher. No user is affected who followed the recommendation to setup XStream's Security Framework with a whitelist! Anyone relying on XStream's default blacklist can immediately switch to a whilelist for the allowed types to avoid the vulnerability. Users of XStream 1.4.14 or below who still want to use XStream default blacklist can use a workaround described in more detailed in the referenced advisories.(CVE-2020-26258)\r\n\r\n XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling. The vulnerability may allow a remote attacker to delete arbitrary know files on the host as log as the executing process has sufficient rights only by manipulating the processed input stream. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.15. The reported vulnerability does not exist running Java 15 or higher. No user is affected, who followed the recommendation to setup XStream's Security Framework with a whitelist! Anyone relying on XStream's default blacklist can immediately switch to a whilelist for the allowed types to avoid the vulnerability. Users of XStream 1.4.14 or below who still want to use XStream default blacklist can use a workaround described in more detailed in the referenced advisories.(CVE-2020-26259)\r\n\r\n

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, a Server-Side Forgery Request vulnerability can be activated when unmarshalling. The vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.15. The reported vulnerability does not exist if running Java 15 or higher. No user is affected who followed the recommendation to setup XStream's Security Framework with a whitelist! Anyone relying on XStream's default blacklist can immediately switch to a whilelist for the allowed types to avoid the vulnerability. Users of XStream 1.4.14 or below who still want to use XStream default blacklist can use a workaround described in more detailed in the referenced advisories.

This update for xstream fixes the following issues:

xstream was updated to version 1.4.15.

• CVE-2020-26217: Fixed a remote code execution due to insecure XML deserialization when relying on blocklists (bsc#1180994).
• CVE-2020-26258: Fixed a server-side request forgery vulnerability (bsc#1180146).
• CVE-2020-26259: Fixed an arbitrary file deletion vulnerability (bsc#1180145).

This update was imported from the SUSE:SLE-15-SP2:Update update project.

These are all security issues fixed in the xstream-1.4.18-1.1 package on the GA media of openSUSE Tumbleweed.

This update for xstream fixes the following issues:

xstream was updated to version 1.4.15.

• CVE-2020-26217: Fixed a remote code execution due to insecure XML deserialization when relying on blocklists (bsc#1180994).
• CVE-2020-26258: Fixed a server-side request forgery vulnerability (bsc#1180146).
• CVE-2020-26259: Fixed an arbitrary file deletion vulnerability (bsc#1180145).

This update fixes the following issues:

cobbler:

• Fix string replacement for @@xyz@@
• Better performing string replacements

grafana-formula:

• Set supported to false for unsupported systems (bsc#1182001)
• Add SLES 15 SP3 and openSUSE Leap 15.3 to supported versions

mgr-libmod:

• Fix 'list_modules' JSON serialization (bsc#1182492)

mgr-osad:

• Adapt to new SSL implementation of rhnlib (bsc#1181807)

prometheus-exporters-formula:

• Add Ubuntu support for Prometheus exporters' reverse proxy

prometheus-formula:

• Set server hostname from pillar data (bsc#1180439)

py26-compat-salt:

• Do not crash when unexpected cmd output at listing patches (bsc#1181290)

rhnlib:

• Change SSL implementation to python ssl for better SAN and hostname matching support (bsc#1181807)

smdba:

• Do not remove the database if there is no backup and deal with manifest

spacewalk-backend:

• Open repomd files as binary (bsc#1173893)
• Fix requesting Release file in debian repos (bsc#1182006)
• Reposync: Fixed Kickstart functionality.
• Reposync: Fixed URLGrabber error handling.
• Reposync: Fix modular data handling for cloned channels (bsc#1177508)

spacewalk-client-tools:

• Adapt to new SSL implementation of rhnlib (bsc#1181807)

spacewalk-config:

• Increase apache ssl logs to include response code and process time

spacewalk-java:

• Homogenizes style in filter buttons, facilitating testability
• Cleanup sessions via SQL query instead of SQL function (bsc#1180224)
• Rebuild and improve rendering of error pages 404 and 500 pages (bsc#1181228)
• Fix user creation with pam auth and no password (bsc#1179579)
• Fix action chains for saltssh minions (bsc#1182200)
• FIX: Slow response of 'Software > Install' in Ubuntu minions (bsc#1181165)
• Do not call page decorator in HEAD requests (bsc#1181228)
• Add 'mgr_origin_server' to Salt pillar data (bsc#1180439)
• Ensure new files are synced just after writing them (bsc#1175660)
• Enable openscap auditing for salt systems in SSM (bsc#1157711)
• Detect debian products (bsc#1181416)
• Show packages from channels assigned to the targeted system (bsc#1181423)
• Add an API endpoint to allow/disallow scheduling irrelevant patches (bsc#1180757)
• Open raw output in new tab for ScriptRunAction (bsc#1180547)
• Default to preferred items per page in content lifecycle lists (bsc#1180558)
• Fix modular data handling for cloned channels (bsc#1177508)
• Fix: login gets an ISE when SSO is enabled (bsc#1181048)

spacewalk-utils:

• Fix modular data handling for cloned channels (bsc#1177508)

spacewalk-web:

• Replace CRLF in ssh priv key when bootstrapping (bsc#1182685)
• Upgrade immer to fix CVE-2020-28477
• Default to preferred items per page in content lifecycle lists (bsc#1180558)
• Fix sorting in content lifecycle projects and cluster tables (bsc#1180558)

susemanager:

• Add SLE 15 SP3 bootstrap repository definitions (bsc#1182008)
• Python3-dbus-python and dependencies not installed by default on JeOS SLE15 images, add them to the bootstrap repository list of packages for traditional (bsc#1182071)

susemanager-doc-indexes:

• Updated Command Line Registration with Salt section in the Client Configuration Guide for clarity.
• Adds openSUSE Leap SP migration to the SP migration section of the Client Configuration Guide
• Adds note that bootstrap procedure for selecting a parent channel is optional in Client Configuration Guide (bsc#1181635)
• Adds note about checking for valid UUIDs in fstab when backing up (bsc#1181814)
• Updated command for running configure proxy script when replacing a proxy
• Fixed bad SUSE Customer Center URL

susemanager-docs_en:

• Updated Command Line Registration with Salt section in the Client Configuration Guide for clarity.
• Adds openSUSE Leap SP migration to the SP migration section of the Client Configuration Guide
• Adds note that bootstrap procedure for selecting a parent channel is optional in Client Configuration Guide (bsc#1181635)
• Adds note about…

Zhihong Tian and Hui Lu found that XStream was vulnerable to remote code execution. A remote attacker could run arbitrary shell commands by manipulating the processed input stream. (CVE-2020-26217)

It was discovered that XStream was vulnerable to server-side forgery attacks. A remote attacker could request data from internal resources that are not publicly available only by manipulating the processed input stream. (CVE-2020-26258)

It was discovered that XStream was vulnerable to arbitrary file deletion on the local host. A remote attacker could use this to delete arbitrary known files on the host as long as the executing process had sufficient rights only by manipulating the processed input stream. (CVE-2020-26259)

Zhihong Tian and Hui Lu found that XStream was vulnerable to remote code execution. A remote attacker could run arbitrary shell commands by manipulating the processed input stream. This issue affected only affected Ubuntu 20.10. (CVE-2020-26217)

It was discovered that XStream was vulnerable to server-side forgery attacks. A remote attacker could request data from internal resources that are not publicly available only by manipulating the processed input stream. This issue only affected Ubuntu 20.10. (CVE-2020-26258)

It was discovered that XStream was vulnerable to arbitrary file deletion on the local host. A remote attacker could use this to delete arbitrary known files on the host as long as the executing process had sufficient rights only by manipulating the processed input stream. This issue only affected Ubuntu 20.10. (CVE-2020-26259)

It was discovered that XStream was vulnerable to denial of service, arbitrary code execution, arbitrary file deletion and server-side forgery attacks. A remote attacker could cause any of those issues by manipulating the processed input stream. (CVE-2021-21341, CVE-2021-21342, CVE-2021-21343 CVE-2021-21344, CVE-2021-21345, CVE-2021-21346, CVE-2021-21347, CVE-2021-21348, CVE-2021-21349, CVE-2021-21350, CVE-2021-21351)

It was discovered that XStream incorrectly handled parsing of certain crafted XML documents. A remote attacker could possibly use this issue to read arbitrary files. (CVE-2016-3674)

Zhihong Tian and Hui Lu found that XStream was vulnerable to remote code execution. A remote attacker could run arbitrary shell commands by manipulating the processed input stream. (CVE-2020-26217)

It was discovered that XStream was vulnerable to server-side forgery attacks. A remote attacker could request data from internal resources that are not publicly available only by manipulating the processed input stream. (CVE-2020-26258)

It was discovered that XStream was vulnerable to arbitrary file deletion on the local host. A remote attacker could use this to delete arbitrary known files on the host as long as the executing process had sufficient rights only by manipulating the processed input stream. (CVE-2020-26259)

It was discovered that XStream was vulnerable to denial of service, arbitrary code execution, arbitrary file deletion and server-side forgery attacks. A remote attacker could cause any of those issues by manipulating the processed input stream. (CVE-2021-21341, CVE-2021-21342, CVE-2021-21343, CVE-2021-21344, CVE-2021-21345, CVE-2021-21346, CVE-2021-21347, CVE-2021-21348, CVE-2021-21349, CVE-2021-21350, CVE-2021-21351)