{"id":"CVE-2020-26217","aliases":["BIT-activemq-2020-26217","CLSA-2026-1794152536","DEBIAN-CVE-2020-26217","DLA-2471-1","DSA-4811-1","EUVD-2020-1464","GHSA-mw36-7c6c-q4q2","RHSA-2021:0162","SUSE-SU-2021:0176-1","SUSE-SU-2021:0906-1","UBUNTU-CVE-2020-26217","USN-4714-1","USN-4943-1","USN-6978-1","openSUSE-SU-2021:0140-1","openSUSE-SU-2024:10592-1"],"status":"published","title":"Remote Code Execution in XStream","description":"XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream. Only users who rely on blocklists are affected. Anyone using XStream's Security Framework allowlist is not affected. The linked advisory provides code workarounds for users who cannot upgrade. The issue is fixed in version 1.4.14.","severity":{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.84968,"percentile":0.99716,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-78"],"published":"2020-11-16T20:07:59Z","modified":"2026-11-08T19:30:02Z","exploits":[{"source":"pocgithub","id":"novysodope/CVE-2020-26217-XStream-RCE-POC","title":"novysodope/CVE-2020-26217-XStream-RCE-POC","date":"2020-12-08","url":"https://github.com/novysodope/CVE-2020-26217-XStream-RCE-POC"},{"source":"pocgithub","id":"Al1ex/CVE-2020-26217","title":"Al1ex/CVE-2020-26217","date":"2021-01-22","url":"https://github.com/Al1ex/CVE-2020-26217"},{"source":"pocgithub","id":"epicosy/XStream-1","title":"epicosy/XStream-1","date":"2024-05-31","url":"https://github.com/epicosy/XStream-1"},{"source":"pocgithub","id":"cuijiung/xstream-CVE-2020-26217","title":"cuijiung/xstream-CVE-2020-26217","date":"2025-07-11","url":"https://github.com/cuijiung/xstream-CVE-2020-26217"},{"source":"pocgithub","id":"shoucheng3/x-stream__xstream_CVE-2020-26217_1-4-14-java77","title":"shoucheng3/x-stream__xstream_CVE-2020-26217_1-4-14-java77","date":"2025-08-23","url":"https://github.com/shoucheng3/x-stream__xstream_CVE-2020-26217_1-4-14-java77"},{"source":"nuclei","id":"CVE-2020-26217","title":"XStream \u003c1.4.14 - Remote Code Execution","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-26217.yaml"}],"fixes":[{"ecosystem":"Maven","package":"com.thoughtworks.xstream:xstream","fixed_in":["1.4.14-java7"],"sources":["ghsa","osv"]},{"ecosystem":"Bitnami","package":"activemq","fixed_in":["5.15.14"],"sources":["osv"]},{"ecosystem":"TuxCare:Maven","package":"com.thoughtworks.xstream:xstream","fixed_in":["1.2.2-tuxcare.1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libxstream-java","fixed_in":["1.4.14-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libxstream-java","fixed_in":["1.4.14-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libxstream-java","fixed_in":["1.4.14-1"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"libxstream-java","fixed_in":["1.4.9-2+deb9u1"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"libxstream-java","fixed_in":["1.4.11.1-1+deb10u1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"xstream","fixed_in":["0:1.3.1-12.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"xstream-javadoc","fixed_in":["0:1.3.1-12.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"xstream","fixed_in":["0:1.3.1-12.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"xstream-javadoc","fixed_in":["0:1.3.1-12.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"xstream","fixed_in":["0:1.3.1-12.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"xstream-javadoc","fixed_in":["0:1.3.1-12.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"xstream","fixed_in":["0:1.3.1-12.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"xstream-javadoc","fixed_in":["0:1.3.1-12.el7_9"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libxstream-java","fixed_in":["1.4.7-1ubuntu0.1+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libxstream-java","fixed_in":["1.4.8-1ubuntu0.1+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"libxstream-java","fixed_in":["1.4.11.1-1~18.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"libxstream-java","fixed_in":["1.4.11.1-1ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"com.thoughtworks.xstream:xstream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.4.13"},{"fixed":"1.4.14-java7"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"activemq","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"5.15.14"}]},{"type":"SEMVER","events":[{"introduced":"5.16.0"},{"last_affected":"5.16.0"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.thoughtworks.xstream:xstream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.2"},{"fixed":"1.2.2-tuxcare.1"}]}],"versions":["1.2.2"]},{"source":"osv","ecosystem":"Debian:12","package":"libxstream-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.14-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libxstream-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.14-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libxstream-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.14-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"libxstream-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.9-2+deb9u1"}]}],"versions":["1.4.9-2"]},{"source":"osv","ecosystem":"Debian:10","package":"libxstream-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.11.1-1+deb10u1"}]}],"versions":["1.4.11.1-1"]},{"source":"osv","ecosystem":"Maven","package":"com.thoughtworks.xstream:xstream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.14-java7"}]}],"versions":["0.1","0.2","0.3","0.5","0.6","1.0","1.0.1","1.0.2","1.1","1.1.1","1.1.2","1.1.3","1.2","1.2.1","1.2.2","1.3","1.3.1","1.4","1.4.1","1.4.10","1.4.10-java7","1.4.11","1.4.11-java7","1.4.11.1","1.4.12","1.4.12-java7","1.4.13","1.4.13-java7","1.4.14","1.4.2","1.4.3","1.4.4","1.4.5","1.4.6","1.4.7","1.4.8","1.4.9"]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"xstream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.1-12.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"xstream-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.1-12.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"xstream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.1-12.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"xstream-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.1-12.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"xstream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.1-12.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"xstream-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.1-12.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"xstream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.1-12.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"xstream-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.1-12.el7_9"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP2","package":"xstream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.15-3.3.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.1","package":"mgr-osad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.5-2.9.4"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.1","package":"rhnlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.3-4.3.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.1","package":"spacewalk-backend","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.21-4.22.7"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.1","package":"spacewalk-client-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.9-4.12.4"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.1","package":"spacewalk-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.4-3.9.4"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.1","package":"spacewalk-proxy-installer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.6-3.3.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.1","package":"spacewalk-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.23-3.18.6"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"cobbler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0+git20190806.32c4bae0-5.6.4"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"grafana-formula","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.0-3.6.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"mgr-libmod","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.7-3.16.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"mgr-osad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.5-2.9.4"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"prometheus-exporters-formula","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.0-3.19.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"prometheus-formula","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.1-3.6.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"py26-compat-salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2016.11.10-6.11.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"rhnlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.3-4.3.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"smdba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.8-0.3.6.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"spacewalk-backend","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.21-4.22.7"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"spacewalk-client-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.9-4.12.4"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"spacewalk-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.5-3.3.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"spacewalk-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.30-3.31.7"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"spacewalk-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.14-3.12.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"spacewalk-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.23-3.18.6"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"subscription-matcher","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26-3.6.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"susemanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.24-3.20.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"susemanager-doc-indexes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1-11.28.4"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"susemanager-docs_en","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1-11.28.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"susemanager-schema","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.19-3.24.4"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"susemanager-sls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.21-3.26.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"xpp3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.4c-11.2.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"xstream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.15-3.5.2"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libxstream-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.7-1ubuntu0.1+esm2"}]}],"versions":["1.4.4-1","1.4.7-1","1.4.7-1ubuntu0.1","1.4.7-1ubuntu0.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libxstream-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.8-1ubuntu0.1+esm3"}]}],"versions":["1.4.8-1","1.4.8-1ubuntu0.1","1.4.8-1ubuntu0.1+esm1","1.4.8-1ubuntu0.1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libxstream-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.11.1-1~18.04.1"}]}],"versions":["1.4.10-1","1.4.11.1-1~18.04"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libxstream-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.11.1-1ubuntu0.1"}]}],"versions":["1.4.11.1-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libxstream-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.11.1-1~18.04.1"}]}],"versions":["1.4.10-1","1.4.11.1-1~18.04"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libxstream-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.11.1-1ubuntu0.1"}]}],"versions":["1.4.11.1-1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libxstream-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.11.1-1~18.04.2"}]}],"versions":["1.4.10-1","1.4.11.1-1~18.04","1.4.11.1-1~18.04.1"],"bundled":14},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libxstream-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.11.1-1ubuntu0.2"}]}],"versions":["1.4.11.1-1","1.4.11.1-1ubuntu0.1"],"bundled":14},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libxstream-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.7-1ubuntu0.1+esm2"}]}],"versions":["1.4.4-1","1.4.7-1","1.4.7-1ubuntu0.1","1.4.7-1ubuntu0.1+esm1"],"bundled":15},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libxstream-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.8-1ubuntu0.1+esm3"}]}],"versions":["1.4.8-1","1.4.8-1ubuntu0.1","1.4.8-1ubuntu0.1+esm1","1.4.8-1ubuntu0.1+esm2"],"bundled":15},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"xstream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.15-lp152.2.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"xstream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.18-1.1"}]}],"bundled":22}],"products":[{"vendor":"apache","product":"activemq"},{"vendor":"debian","product":"debian_linux"},{"vendor":"netapp","product":"snapmanager"},{"vendor":"oracle","product":"banking_cash_management"},{"vendor":"oracle","product":"banking_corporate_lending_process_management"},{"vendor":"oracle","product":"banking_credit_facilities_process_management"},{"vendor":"oracle","product":"banking_platform"},{"vendor":"oracle","product":"banking_supply_chain_finance"},{"vendor":"oracle","product":"banking_trade_finance_process_management"},{"vendor":"oracle","product":"banking_virtual_account_management"},{"vendor":"oracle","product":"business_activity_monitoring"},{"vendor":"oracle","product":"communications_policy_management"},{"vendor":"oracle","product":"endeca_information_discovery_studio"},{"vendor":"oracle","product":"retail_xstore_point_of_service"},{"vendor":"x-stream","product":"xstream"},{"vendor":"xstream","product":"xstream"}],"references":[{"url":"https://github.com/x-stream/xstream/security/advisories/GHSA-mw36-7c6c-q4q2","tags":["x_refsource_CONFIRM","x_transferred","Mitigation","Third Party Advisory","advisory","web","report"]},{"url":"https://x-stream.github.io/CVE-2020-26217.html","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Mitigation","Vendor Advisory","advisory","evidence","web","report"]},{"url":"https://github.com/x-stream/xstream/commit/0fec095d534126931c99fd38e9c6d41f5c685c1a","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","advisory","fix","web","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/12/msg00001.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://www.debian.org/security/2020/dsa-4811","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://lists.apache.org/thread.html/redde3609b89b2a4ff18b536a06ef9a77deb93d47fda8ed28086fa8c3%40%3Cissues.activemq.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","Issue Tracking","Mailing List","report"]},{"url":"https://lists.apache.org/thread.html/r826a006fda71cc96fc87b6eca4b5d195f19a292ad36cea501682c38c%40%3Cissues.activemq.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","Issue Tracking","Mailing List","report"]},{"url":"https://lists.apache.org/thread.html/r2de526726e7f4db4a7cb91b7355070779f51a84fd985c6529c2f4e9e%40%3Cissues.activemq.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","Issue Tracking","Mailing List","report"]},{"url":"https://www.oracle.com/security-alerts/cpuApr2021.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","advisory","fix","web"]},{"url":"https://security.netapp.com/advisory/ntap-20210409-0004/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.oracle.com//security-alerts/cpujul2021.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","advisory","fix","web"]},{"url":"https://lists.apache.org/thread.html/r7c9fc255edc0b9cd9567093d131f6d33fde4c662aaf912460ef630e9%40%3Ccommits.camel.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","Issue Tracking","Mailing List","report"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2021.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","advisory","fix","web"]},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","tags":["x_refsource_MISC","x_transferred","Not Applicable","Third Party Advisory","advisory","web"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","tags":["x_refsource_MISC","x_transferred","Not Applicable","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-26217","tags":["web","advisory"]},{"url":"https://lists.apache.org/thread.html/r826a006fda71cc96fc87b6eca4b5d195f19a292ad36cea501682c38c@%3Cissues.activemq.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/redde3609b89b2a4ff18b536a06ef9a77deb93d47fda8ed28086fa8c3@%3Cissues.activemq.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r2de526726e7f4db4a7cb91b7355070779f51a84fd985c6529c2f4e9e@%3Cissues.activemq.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r7c9fc255edc0b9cd9567093d131f6d33fde4c662aaf912460ef630e9@%3Ccommits.camel.apache.org%3E","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20210409-0004","tags":["web"]},{"url":"https://github.com/advisories/GHSA-mw36-7c6c-q4q2"},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-26217","tags":["advisory"]},{"url":"https://github.com/x-stream/xstream","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2021:0162","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1898907","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0162.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-26217","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-26217","tags":["advisory","report"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20210176-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1180145","tags":["report"]},{"url":"https://bugzilla.suse.com/1180146","tags":["report"]},{"url":"https://bugzilla.suse.com/1180994","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26217","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26258","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26259","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20210906-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1157711","tags":["report"]},{"url":"https://bugzilla.suse.com/1173893","tags":["report"]},{"url":"https://bugzilla.suse.com/1175660","tags":["report"]},{"url":"https://bugzilla.suse.com/1177508","tags":["report"]},{"url":"https://bugzilla.suse.com/1179579","tags":["report"]},{"url":"https://bugzilla.suse.com/1180224","tags":["report"]},{"url":"https://bugzilla.suse.com/1180439","tags":["report"]},{"url":"https://bugzilla.suse.com/1180547","tags":["report"]},{"url":"https://bugzilla.suse.com/1180558","tags":["report"]},{"url":"https://bugzilla.suse.com/1180757","tags":["report"]},{"url":"https://bugzilla.suse.com/1181048","tags":["report"]},{"url":"https://bugzilla.suse.com/1181165","tags":["report"]},{"url":"https://bugzilla.suse.com/1181228","tags":["report"]},{"url":"https://bugzilla.suse.com/1181290","tags":["report"]},{"url":"https://bugzilla.suse.com/1181416","tags":["report"]},{"url":"https://bugzilla.suse.com/1181423","tags":["report"]},{"url":"https://bugzilla.suse.com/1181635","tags":["report"]},{"url":"https://bugzilla.suse.com/1181807","tags":["report"]},{"url":"https://bugzilla.suse.com/1181814","tags":["report"]},{"url":"https://bugzilla.suse.com/1182001","tags":["report"]},{"url":"https://bugzilla.suse.com/1182006","tags":["report"]},{"url":"https://bugzilla.suse.com/1182008","tags":["report"]},{"url":"https://bugzilla.suse.com/1182071","tags":["report"]},{"url":"https://bugzilla.suse.com/1182200","tags":["report"]},{"url":"https://bugzilla.suse.com/1182492","tags":["report"]},{"url":"https://bugzilla.suse.com/1182685","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-28477","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2020-26217","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4714-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-4943-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-6978-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-26258","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-26259","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-21341","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-21342","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-21343","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-21344","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-21345","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-21346","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-21347","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-21348","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-21349","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-21350","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-21351","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-3674","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/CTO6QRFLVKVHOYBP6VLJP4KZXZFZSKET/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3674","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7957","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21341","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21342","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21343","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21344","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21345","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21346","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21347","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21348","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21349","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21350","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21351","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-29505","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-39139","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-39144","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-39147","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-39150","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-39153","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2020-26217","title":"Remote Code Execution in XStream","description":"XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream. Only users who rely on blocklists are affected. Anyone using XStream's Security Framework allowlist is not affected. The linked advisory provides code workarounds for users who cannot upgrade. The issue is fixed in version 1.4.14.","status":"published","published":"2020-11-16T21:00:18Z","modified":"2026-10-07T18:51:32.843Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:35:45.763329Z"}],"euvd":[{"id":"EUVD-2020-1464","description":"XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream. Only users who rely on blocklists are affected. Anyone using XStream's Security Framework allowlist is not affected. The linked advisory provides code workarounds for users who cannot upgrade. The issue is fixed in version 1.4.14.","status":"published","published":"2020-11-16T21:00:18Z","modified":"2026-10-07T18:51:32Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T17:27:34.353796Z"}],"ghsa":[{"id":"GHSA-mw36-7c6c-q4q2","title":"XStream can be used for Remote Code Execution","description":"### Impact\nThe vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream.\n\n### Patches\nIf you rely on XStream's default blacklist of the [Security Framework](https://x-stream.github.io/security.html#framework), you will have to use at least version 1.4.14.\n\n### Workarounds\nNo user is affected, who followed the recommendation to setup XStream's Security Framework with a whitelist! Anyone relying on XStream's default blacklist can immediately switch to a whilelist for the allowed types to avoid the vulnerability.\n\nUsers of XStream 1.4.13 or below who still want to use XStream default blacklist can use a workaround depending on their version in use.\n\nUsers of XStream 1.4.13 can simply add two lines to XStream's setup code:\n```Java\nxstream.denyTypes(new String[]{ \"javax.imageio.ImageIO$ContainsFilter\" });\nxstream.denyTypes(new Class[]{ java.lang.ProcessBuilder.class });\n```\nUsers of XStream 1.4.12 to 1.4.7 who want to use XStream with a black list will have to setup such a list from scratch and deny at least the following types: _javax.imageio.ImageIO$ContainsFilter_, _java.beans.EventHandler_, _java.lang.ProcessBuilder_, _java.lang.Void_ and _void_.\n```Java\nxstream.denyTypes(new String[]{ \"javax.imageio.ImageIO$ContainsFilter\" });\nxstream.denyTypes(new Class[]{ java.lang.ProcessBuilder.class, java.beans.EventHandler.class, java.lang.ProcessBuilder.class, java.lang.Void.class, void.class });\n```\nUsers of XStream 1.4.6 or below can register an own converter to prevent the unmarshalling of the currently know critical types of the Java runtime. It is in fact an updated version of the workaround for CVE-2013-7285:\n```Java\nxstream.registerConverter(new Converter() {\n  public boolean canConvert(Class type) {\n    return type != null \u0026\u0026 (type == java.beans.EventHandler.class || type == java.lang.ProcessBuilder.class || type == java.lang.Void.class || void.class || type.getName().equals(\"javax.imageio.ImageIO$ContainsFilter\") || Proxy.isProxy(type));\n  }\n\n  public Object unmarshal(HierarchicalStreamReader reader, UnmarshallingContext context) {\n    throw new ConversionException(\"Unsupported type due to security reasons.\");\n  }\n\n  public void marshal(Object source, HierarchicalStreamWriter writer, MarshallingContext context) {\n    throw new ConversionException(\"Unsupported type due to security reasons.\");\n  }\n}, XStream.PRIORITY_LOW);\n```\n\n### Credits\nChen L found and reported the issue to XStream and provided the required information to reproduce it.  He was supported by Zhihong Tian and Hui Lu, both from Guangzhou University.\n\n### References\nSee full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for [CVE-2020-26217](https://x-stream.github.io/CVE-2020-26217.html).\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [XStream](https://github.com/x-stream/xstream/issues)\n* Contact us at [XStream Google Group](https://groups.google.com/group/xstream-user)","status":"published","published":"2020-11-16T20:07:59Z","modified":"2025-09-03T15:04:45Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:38:55.953734Z"}],"nvd":[{"id":"CVE-2020-26217","description":"XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream. Only users who rely on blocklists are affected. Anyone using XStream's Security Framework allowlist is not affected. The linked advisory provides code workarounds for users who cannot upgrade. The issue is fixed in version 1.4.14.","status":"published","published":"2020-11-16T21:15:12.893Z","modified":"2026-10-07T19:17:17.07Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":9.3,"vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:06:24.137599Z"}],"osv":[{"id":"CVE-2020-26217","description":"XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream. Only users who rely on blocklists are affected. Anyone using XStream's Security Framework allowlist is not affected. The linked advisory provides code workarounds for users who cannot upgrade. The issue is fixed in version 1.4.14.","status":"published","published":"2020-11-16T21:15:12.893Z","modified":"2026-10-24T14:22:40.901810848Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:15.879068Z"},{"id":"DEBIAN-CVE-2020-26217","description":"XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream. Only users who rely on blocklists are affected. Anyone using XStream's Security Framework allowlist is not affected. The linked advisory provides code workarounds for users who cannot upgrade. The issue is fixed in version 1.4.14.","status":"published","published":"2020-11-16T21:15:12.893Z","modified":"2026-10-26T12:02:40.840225045Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:33.729655Z"},{"id":"GHSA-mw36-7c6c-q4q2","title":"XStream can be used for Remote Code Execution","description":"### Impact\nThe vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream.\n\n### Patches\nIf you rely on XStream's default blacklist of the [Security Framework](https://x-stream.github.io/security.html#framework), you will have to use at least version 1.4.14.\n\n### Workarounds\nNo user is affected, who followed the recommendation to setup XStream's Security Framework with a whitelist! Anyone relying on XStream's default blacklist can immediately switch to a whilelist for the allowed types to avoid the vulnerability.\n\nUsers of XStream 1.4.13 or below who still want to use XStream default blacklist can use a workaround depending on their version in use.\n\nUsers of XStream 1.4.13 can simply add two lines to XStream's setup code:\n```Java\nxstream.denyTypes(new String[]{ \"javax.imageio.ImageIO$ContainsFilter\" });\nxstream.denyTypes(new Class[]{ java.lang.ProcessBuilder.class });\n```\nUsers of XStream 1.4.12 to 1.4.7 who want to use XStream with a black list will have to setup such a list from scratch and deny at least the following types: _javax.imageio.ImageIO$ContainsFilter_, _java.beans.EventHandler_, _java.lang.ProcessBuilder_, _java.lang.Void_ and _void_.\n```Java\nxstream.denyTypes(new String[]{ \"javax.imageio.ImageIO$ContainsFilter\" });\nxstream.denyTypes(new Class[]{ java.lang.ProcessBuilder.class, java.beans.EventHandler.class, java.lang.ProcessBuilder.class, java.lang.Void.class, void.class });\n```\nUsers of XStream 1.4.6 or below can register an own converter to prevent the unmarshalling of the currently know critical types of the Java runtime. It is in fact an updated version of the workaround for CVE-2013-7285:\n```Java\nxstream.registerConverter(new Converter() {\n  public boolean canConvert(Class type) {\n    return type != null \u0026\u0026 (type == java.beans.EventHandler.class || type == java.lang.ProcessBuilder.class || type == java.lang.Void.class || void.class || type.getName().equals(\"javax.imageio.ImageIO$ContainsFilter\") || Proxy.isProxy(type));\n  }\n\n  public Object unmarshal(HierarchicalStreamReader reader, UnmarshallingContext context) {\n    throw new ConversionException(\"Unsupported type due to security reasons.\");\n  }\n\n  public void marshal(Object source, HierarchicalStreamWriter writer, MarshallingContext context) {\n    throw new ConversionException(\"Unsupported type due to security reasons.\");\n  }\n}, XStream.PRIORITY_LOW);\n```\n\n### Credits\nChen L found and reported the issue to XStream and provided the required information to reproduce it.  He was supported by Zhihong Tian and Hui Lu, both from Guangzhou University.\n\n### References\nSee full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for [CVE-2020-26217](https://x-stream.github.io/CVE-2020-26217.html).\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [XStream](https://github.com/x-stream/xstream/issues)\n* Contact us at [XStream Google Group](https://groups.google.com/group/xstream-user)","status":"published","published":"2020-11-16T20:07:59Z","modified":"2026-07-08T05:59:56.42200631Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:46:52.170928Z"},{"id":"RHSA-2021:0162","title":"Red Hat Security Advisory: xstream security update","status":"published","published":"2024-09-16T05:10:34Z","modified":"2026-10-08T10:02:17Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:08.071325Z"},{"id":"UBUNTU-CVE-2020-26217","description":"XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream. Only users who rely on blocklists are affected. Anyone using XStream's Security Framework allowlist is not affected. The linked advisory provides code workarounds for users who cannot upgrade. The issue is fixed in version 1.4.14.","status":"published","published":"2020-11-16T21:15:00Z","modified":"2026-02-04T03:34:55.925217Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:23.905183Z"},{"id":"BIT-activemq-2020-26217","title":"Remote Code Execution in XStream","description":"XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream. Only users who rely on blocklists are affected. Anyone using XStream's Security Framework allowlist is not affected. The linked advisory provides code workarounds for users who cannot upgrade. The issue is fixed in version 1.4.14.","status":"published","published":"2025-12-03T14:35:16.352Z","modified":"2026-09-08T08:45:11.441052609Z","updated_at":"2026-11-02T15:28:28.267217Z"},{"id":"CLSA-2026-1794152536","title":"TuxCare security update for com.thoughtworks.xstream:xstream (1 CVE)","description":"TuxCare rebuilt com.thoughtworks.xstream:xstream to address 1 CVE. Fixed in 1.2.2-tuxcare.1.","status":"published","published":"2026-11-08T16:42:17Z","modified":"2026-11-08T19:30:02.424516239Z","updated_at":"2026-11-08T19:39:23.584635Z"},{"id":"DLA-2471-1","title":"libxstream-java - security update","status":"published","published":"2020-11-30T00:00:00Z","modified":"2026-03-09T01:18:26.360249Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"DSA-4811-1","title":"libxstream-java - security update","status":"published","published":"2020-12-15T00:00:00Z","modified":"2026-03-09T02:08:56.300802Z","updated_at":"2026-11-02T15:46:17.19998Z"},{"id":"openSUSE-SU-2021:0140-1","title":"Security update for xstream","description":"This update for xstream fixes the following issues:\n\nxstream was updated to version 1.4.15.\n\n- CVE-2020-26217: Fixed a remote code execution due to insecure XML deserialization when relying on blocklists (bsc#1180994).\n- CVE-2020-26258: Fixed a server-side request forgery vulnerability (bsc#1180146).\n- CVE-2020-26259: Fixed an arbitrary file deletion vulnerability (bsc#1180145).\n\nThis update was imported from the SUSE:SLE-15-SP2:Update update project.","status":"published","published":"2021-01-22T16:22:21Z","modified":"2026-02-04T03:04:16.463536Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2024:10592-1","title":"xstream-1.4.18-1.1 on GA media","description":"These are all security issues fixed in the xstream-1.4.18-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:40:43.193438Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-SU-2021:0176-1","title":"Security update for xstream","description":"This update for xstream fixes the following issues:\n\nxstream was updated to version 1.4.15.\n\n- CVE-2020-26217: Fixed a remote code execution due to insecure XML deserialization when relying on blocklists (bsc#1180994).\n- CVE-2020-26258: Fixed a server-side request forgery vulnerability (bsc#1180146).\n- CVE-2020-26259: Fixed an arbitrary file deletion vulnerability (bsc#1180145).\n","status":"published","published":"2021-01-20T08:49:09Z","modified":"2026-02-04T02:56:24.28293Z","updated_at":"2026-11-02T15:53:48.690034Z"},{"id":"SUSE-SU-2021:0906-1","title":"Security update for SUSE Manager Server 4.1","description":"This update fixes the following issues:\n\ncobbler:\n\n- Fix string replacement for @@xyz@@\n- Better performing string replacements\n\ngrafana-formula:\n\n- Set `supported` to false for unsupported systems (bsc#1182001)\n- Add SLES 15 SP3 and openSUSE Leap 15.3 to supported versions\n\nmgr-libmod:\n\n- Fix 'list_modules' JSON serialization (bsc#1182492)\n\nmgr-osad:\n\n- Adapt to new SSL implementation of rhnlib (bsc#1181807)\n\nprometheus-exporters-formula:\n\n- Add Ubuntu support for Prometheus exporters' reverse proxy\n\nprometheus-formula:\n\n- Set server hostname from pillar data (bsc#1180439)\n\npy26-compat-salt:\n\n- Do not crash when unexpected cmd output at listing patches (bsc#1181290)\n\nrhnlib:\n\n- Change SSL implementation to python ssl for better SAN and\n  hostname matching support (bsc#1181807)\n\nsmdba:\n\n- Do not remove the database if there is no backup and deal with manifest\n\nspacewalk-backend:\n\n- Open repomd files as binary (bsc#1173893)\n- Fix requesting Release file in debian repos (bsc#1182006)\n- Reposync: Fixed Kickstart functionality.\n- Reposync: Fixed URLGrabber error handling.\n- Reposync: Fix modular data handling for cloned channels (bsc#1177508)\n\nspacewalk-client-tools:\n\n- Adapt to new SSL implementation of rhnlib (bsc#1181807)\n\nspacewalk-config:\n\n- Increase apache ssl logs to include response code and process time\n\nspacewalk-java:\n\n- Homogenizes style in filter buttons, facilitating testability\n- Cleanup sessions via SQL query instead of SQL function (bsc#1180224)\n- Rebuild and improve rendering of error pages 404 and 500 pages (bsc#1181228)\n- Fix user creation with pam auth and no password (bsc#1179579)\n- Fix action chains for saltssh minions (bsc#1182200)\n- FIX: Slow response of 'Software \u003e Install' in Ubuntu minions (bsc#1181165)\n- Do not call page decorator in HEAD requests (bsc#1181228)\n- Add 'mgr_origin_server' to Salt pillar data (bsc#1180439)\n- Ensure new files are synced just after writing them (bsc#1175660)\n- Enable openscap auditing for salt systems in SSM (bsc#1157711)\n- Detect debian products (bsc#1181416)\n- Show packages from channels assigned to the targeted system (bsc#1181423)\n- Add an API endpoint to allow/disallow scheduling irrelevant patches (bsc#1180757)\n- Open raw output in new tab for ScriptRunAction (bsc#1180547)\n- Default to preferred items per page in content lifecycle lists (bsc#1180558)\n- Fix modular data handling for cloned channels (bsc#1177508)\n- Fix: login gets an ISE when SSO is enabled (bsc#1181048)\n\nspacewalk-utils:\n\n- Fix modular data handling for cloned channels (bsc#1177508)\n\nspacewalk-web:\n\n- Replace CRLF in ssh priv key when bootstrapping (bsc#1182685)\n- Upgrade immer to fix CVE-2020-28477\n- Default to preferred items per page in content lifecycle lists (bsc#1180558)\n- Fix sorting in content lifecycle projects and cluster tables (bsc#1180558)\n\nsusemanager:\n\n- Add SLE 15 SP3 bootstrap repository definitions (bsc#1182008)\n- Python3-dbus-python and dependencies not installed by default\n  on JeOS SLE15 images, add them to the bootstrap repository list\n  of packages for traditional (bsc#1182071)\n\nsusemanager-doc-indexes:\n\n- Updated Command Line Registration with Salt section in the Client\n  Configuration Guide for clarity.\n- Adds openSUSE Leap SP migration to the SP migration section of the Client\n  Configuration Guide\n- Adds note that bootstrap procedure for selecting a parent\n  channel is optional in Client Configuration Guide (bsc#1181635)\n- Adds note about checking for valid UUIDs in fstab\n  when backing up (bsc#1181814)\n- Updated command for running configure proxy script when replacing a proxy\n- Fixed bad SUSE Customer Center URL\n\nsusemanager-docs_en:\n\n- Updated Command Line Registration with Salt section in the Client\n  Configuration Guide for clarity.\n- Adds openSUSE Leap SP migration to the SP migration section of the Client\n  Configuration Guide\n- Adds note that bootstrap procedure for selecting a parent\n  channel is optional in Client Configuration Guide (bsc#1181635)\n- Adds note about checking for valid UUIDs in fstab\n  when backing up (bsc#1181814)\n- Updated command for running configure proxy script when replacing a proxy\n- Fixed bad SUSE Customer Center URL\n\nsusemanager-schema:\n\n- Drop 'pxt_session_cleanup' function (bsc#1180224)\n- Enable openscap auditing for salt systems in SSM (bsc#1157711)\n\nsusemanager-sls:\n\n- Ubuntu 18 has version of apt which does not correctly support\n  auth.conf.d directory. Detect the working version and use this feature\n  only when we have a higher version installed\n\nxstream:\n\nUpgrade to 1.4.15\n\n- fixes bsc#1180146, CVE-2020-26258 and bsc#1180145, CVE-2020-26259\n- fixes bsc#1180994, CVE-2020-26217\n\nsubscription-matcher:\n\n- Update the xstream dependency to 1.4.15\n\nHow to apply this update:\n1. Log in as root user to the SUSE Manager server.\n2. Stop the Spacewalk service:\n`spacewalk-service stop`\n3. Apply the patch using either zypper patch or YaST Online Update.\n4. Start the Spacewalk service:\n`spacewalk-service start`\n","status":"published","published":"2021-03-19T15:18:39Z","modified":"2026-02-04T02:16:30.339534Z","updated_at":"2026-11-02T15:53:48.690034Z"},{"id":"USN-4714-1","title":"libxstream-java vulnerabilities","description":"Zhihong Tian and Hui Lu found that XStream was vulnerable to remote code\nexecution. A remote attacker could run arbitrary shell commands by\nmanipulating the processed input stream. (CVE-2020-26217)\n\nIt was discovered that XStream was vulnerable to server-side forgery attacks.\nA remote attacker could request data from internal resources that are not\npublicly available only by manipulating the processed input stream.\n(CVE-2020-26258)\n\nIt was discovered that XStream was vulnerable to arbitrary file deletion on\nthe local host. A remote attacker could use this to delete arbitrary known\nfiles on the host as long as the executing process had sufficient rights only\nby manipulating the processed input stream. (CVE-2020-26259)\n","status":"published","published":"2021-01-28T20:38:34Z","modified":"2026-02-10T04:42:02Z","updated_at":"2026-11-02T16:58:15.159055Z"},{"id":"USN-4943-1","title":"libxstream-java vulnerabilities","description":"Zhihong Tian and Hui Lu found that XStream was vulnerable to remote code\nexecution. A remote attacker could run arbitrary shell commands by\nmanipulating the processed input stream. This issue affected only affected\nUbuntu 20.10. (CVE-2020-26217)\n\nIt was discovered that XStream was vulnerable to server-side forgery attacks.\nA remote attacker could request data from internal resources that are not\npublicly available only by manipulating the processed input stream. This\nissue only affected Ubuntu 20.10. (CVE-2020-26258)\n\nIt was discovered that XStream was vulnerable to arbitrary file deletion on\nthe local host. A remote attacker could use this to delete arbitrary known\nfiles on the host as long as the executing process had sufficient rights only\nby manipulating the processed input stream. This issue only affected\nUbuntu 20.10. (CVE-2020-26259)\n\nIt was discovered that XStream was vulnerable to denial of service,\narbitrary code execution, arbitrary file deletion and server-side forgery\nattacks. A remote attacker could cause any of those issues by manipulating\nthe processed input stream. (CVE-2021-21341, CVE-2021-21342, CVE-2021-21343\nCVE-2021-21344, CVE-2021-21345, CVE-2021-21346, CVE-2021-21347,\nCVE-2021-21348, CVE-2021-21349, CVE-2021-21350, CVE-2021-21351)\n","status":"published","published":"2021-05-11T09:41:13Z","modified":"2026-04-27T16:03:36.609273828Z","updated_at":"2026-11-02T16:58:15.159055Z"},{"id":"USN-6978-1","title":"libxstream-java vulnerabilities","description":"It was discovered that XStream incorrectly handled parsing of certain\ncrafted XML documents. A remote attacker could possibly use this issue to\nread arbitrary files. (CVE-2016-3674)\n\nZhihong Tian and Hui Lu found that XStream was vulnerable to remote code\nexecution. A remote attacker could run arbitrary shell commands by\nmanipulating the processed input stream. (CVE-2020-26217)\n\nIt was discovered that XStream was vulnerable to server-side forgery\nattacks. A remote attacker could request data from internal resources\nthat are not publicly available only by manipulating the processed input\nstream. (CVE-2020-26258)\n\nIt was discovered that XStream was vulnerable to arbitrary file deletion\non the local host. A remote attacker could use this to delete arbitrary\nknown files on the host as long as the executing process had sufficient\nrights only by manipulating the processed input stream. (CVE-2020-26259)\n\nIt was discovered that XStream was vulnerable to denial of service,\narbitrary code execution, arbitrary file deletion and server-side forgery\nattacks. A remote attacker could cause any of those issues by\nmanipulating the processed input stream. (CVE-2021-21341, CVE-2021-21342,\nCVE-2021-21343, CVE-2021-21344, CVE-2021-21345, CVE-2021-21346,\nCVE-2021-21347, CVE-2021-21348, CVE-2021-21349, CVE-2021-21350,\nCVE-2021-21351)\n","status":"published","published":"2024-08-22T15:18:01Z","modified":"2026-06-29T13:51:15.787793258Z","updated_at":"2026-11-02T16:58:18.876384Z"}]}}