{"id":"CVE-2020-26258","aliases":["DEBIAN-CVE-2020-26258","DLA-2507-1","DSA-4828-1","EUVD-2020-1481","GHSA-4cch-wxpw-8p28","OESA-2021-1015","SUSE-SU-2021:0176-1","SUSE-SU-2021:0906-1","UBUNTU-CVE-2020-26258","USN-4714-1","USN-4943-1","USN-6978-1","openSUSE-SU-2021:0140-1","openSUSE-SU-2024:10592-1"],"status":"published","title":"Server-Side Forgery Request can be activated unmarshalling with XStream","description":"XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, a Server-Side Forgery Request vulnerability can be activated when unmarshalling. The vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.15. The reported vulnerability does not exist if running Java 15 or higher. No user is affected who followed the recommendation to setup XStream's Security Framework with a whitelist! Anyone relying on XStream's default blacklist can immediately switch to a whilelist for the allowed types to avoid the vulnerability. Users of XStream 1.4.14 or below who still want to use XStream default blacklist can use a workaround described in more detailed in the referenced advisories.","severity":{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.81817,"percentile":0.99649,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-918"],"published":"2020-12-16T01:05:22Z","modified":"2026-10-26T12:01:06Z","exploits":[{"source":"pocgithub","id":"Al1ex/CVE-2020-26258","title":"Al1ex/CVE-2020-26258","date":"2021-01-22","url":"https://github.com/Al1ex/CVE-2020-26258"},{"source":"pocgithub","id":"cuijiung/xstream-CVE-2020-26258","title":"cuijiung/xstream-CVE-2020-26258","date":"2025-07-11","url":"https://github.com/cuijiung/xstream-CVE-2020-26258"},{"source":"nuclei","id":"CVE-2020-26258","title":"XStream \u003c1.4.15 - Server-Side Request Forgery","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-26258.yaml"}],"fixes":[{"ecosystem":"Maven","package":"com.thoughtworks.xstream:xstream","fixed_in":["1.4.15"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"libxstream-java","fixed_in":["1.4.15-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libxstream-java","fixed_in":["1.4.15-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libxstream-java","fixed_in":["1.4.15-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libxstream-java","fixed_in":["1.4.7-1ubuntu0.1+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libxstream-java","fixed_in":["1.4.8-1ubuntu0.1+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"libxstream-java","fixed_in":["1.4.11.1-1~18.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"libxstream-java","fixed_in":["1.4.11.1-1ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"com.thoughtworks.xstream:xstream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.15"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libxstream-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.15-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libxstream-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.15-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libxstream-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.15-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"libxstream-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.11.1-1+deb9u1"}]}],"versions":["1.4.10-1","1.4.11-1","1.4.11.1-1","1.4.9-2","1.4.9-2+deb9u1"],"bundled":2},{"source":"osv","ecosystem":"Debian:10","package":"libxstream-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.11.1-1+deb10u2"}]}],"versions":["1.4.11.1-1","1.4.11.1-1+deb10u1"],"bundled":2},{"source":"osv","ecosystem":"Maven","package":"com.thoughtworks.xstream:xstream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.15"}]}],"versions":["0.1","0.2","0.3","0.5","0.6","1.0","1.0.1","1.0.2","1.1","1.1.1","1.1.2","1.1.3","1.2","1.2.1","1.2.2","1.3","1.3.1","1.4","1.4.1","1.4.10","1.4.10-java7","1.4.11","1.4.11-java7","1.4.11.1","1.4.12","1.4.12-java7","1.4.13","1.4.13-java7","1.4.14","1.4.14-java7","1.4.14-jdk7","1.4.2","1.4.3","1.4.4","1.4.5","1.4.6","1.4.7","1.4.8","1.4.9"]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"xstream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.11.1-3.oe1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP2","package":"xstream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.15-3.3.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.1","package":"mgr-osad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.5-2.9.4"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.1","package":"rhnlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.3-4.3.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.1","package":"spacewalk-backend","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.21-4.22.7"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.1","package":"spacewalk-client-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.9-4.12.4"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.1","package":"spacewalk-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.4-3.9.4"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.1","package":"spacewalk-proxy-installer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.6-3.3.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.1","package":"spacewalk-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.23-3.18.6"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"cobbler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0+git20190806.32c4bae0-5.6.4"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"grafana-formula","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.0-3.6.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"mgr-libmod","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.7-3.16.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"mgr-osad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.5-2.9.4"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"prometheus-exporters-formula","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.0-3.19.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"prometheus-formula","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.1-3.6.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"py26-compat-salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2016.11.10-6.11.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"rhnlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.3-4.3.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"smdba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.8-0.3.6.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"spacewalk-backend","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.21-4.22.7"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"spacewalk-client-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.9-4.12.4"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"spacewalk-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.5-3.3.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"spacewalk-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.30-3.31.7"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"spacewalk-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.14-3.12.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"spacewalk-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.23-3.18.6"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"subscription-matcher","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26-3.6.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"susemanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.24-3.20.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"susemanager-doc-indexes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1-11.28.4"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"susemanager-docs_en","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1-11.28.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"susemanager-schema","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.19-3.24.4"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"susemanager-sls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.21-3.26.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"xpp3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.4c-11.2.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"xstream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.15-3.5.2"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libxstream-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.7-1ubuntu0.1+esm2"}]}],"versions":["1.4.4-1","1.4.7-1","1.4.7-1ubuntu0.1","1.4.7-1ubuntu0.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libxstream-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.8-1ubuntu0.1+esm3"}]}],"versions":["1.4.8-1","1.4.8-1ubuntu0.1","1.4.8-1ubuntu0.1+esm1","1.4.8-1ubuntu0.1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libxstream-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.11.1-1~18.04.1"}]}],"versions":["1.4.10-1","1.4.11.1-1~18.04"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libxstream-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.11.1-1ubuntu0.1"}]}],"versions":["1.4.11.1-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libxstream-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.11.1-1~18.04.1"}]}],"versions":["1.4.10-1","1.4.11.1-1~18.04"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libxstream-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.11.1-1ubuntu0.1"}]}],"versions":["1.4.11.1-1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libxstream-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.11.1-1~18.04.2"}]}],"versions":["1.4.10-1","1.4.11.1-1~18.04","1.4.11.1-1~18.04.1"],"bundled":14},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libxstream-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.11.1-1ubuntu0.2"}]}],"versions":["1.4.11.1-1","1.4.11.1-1ubuntu0.1"],"bundled":14},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libxstream-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.7-1ubuntu0.1+esm2"}]}],"versions":["1.4.4-1","1.4.7-1","1.4.7-1ubuntu0.1","1.4.7-1ubuntu0.1+esm1"],"bundled":15},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libxstream-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.8-1ubuntu0.1+esm3"}]}],"versions":["1.4.8-1","1.4.8-1ubuntu0.1","1.4.8-1ubuntu0.1+esm1","1.4.8-1ubuntu0.1+esm2"],"bundled":15},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"xstream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.15-lp152.2.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"xstream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.18-1.1"}]}],"bundled":22}],"products":[{"vendor":"apache","product":"struts"},{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"x-stream","product":"xstream"},{"vendor":"xstream","product":"xstream"}],"references":[{"url":"https://github.com/x-stream/xstream/security/advisories/GHSA-4cch-wxpw-8p28","tags":["x_refsource_CONFIRM","x_transferred","Mitigation","Third Party Advisory","advisory","web","report"]},{"url":"https://lists.apache.org/thread.html/r97993e3d78e1f5389b7b172ba9f308440830ce5f051ee62714a0aa34@%3Ccommits.struts.apache.org%3E","tags":["x_refsource_MISC","Issue Tracking","Mailing List","report","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/12/msg00042.html","tags":["x_refsource_MISC","mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP","tags":["x_refsource_MISC","Mailing List","article","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7","tags":["x_refsource_MISC","Mailing List","article","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB","tags":["x_refsource_MISC","Mailing List","article","web"]},{"url":"https://security.netapp.com/advisory/ntap-20210409-0005","tags":["x_refsource_MISC","Third Party Advisory","advisory","web"]},{"url":"https://www.debian.org/security/2021/dsa-4828","tags":["x_refsource_MISC","vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://x-stream.github.io/CVE-2020-26258.html","tags":["x_refsource_MISC","x_transferred","Exploit","Mitigation","Third Party Advisory","evidence","web","report"]},{"url":"https://lists.apache.org/thread.html/r97993e3d78e1f5389b7b172ba9f308440830ce5f051ee62714a0aa34%40%3Ccommits.struts.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","Issue Tracking","Mailing List","report","web"]},{"url":"https://security.netapp.com/advisory/ntap-20210409-0005/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Mailing List","article"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Mailing List","article"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Mailing List","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-26258","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB","tags":["web"]},{"url":"https://github.com/advisories/GHSA-4cch-wxpw-8p28"},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-26258","tags":["advisory"]},{"url":"https://github.com/x-stream/xstream","tags":["package"]},{"url":"https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1015","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-26259","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20210176-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1180145","tags":["report"]},{"url":"https://bugzilla.suse.com/1180146","tags":["report"]},{"url":"https://bugzilla.suse.com/1180994","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26217","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26258","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26259","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20210906-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1157711","tags":["report"]},{"url":"https://bugzilla.suse.com/1173893","tags":["report"]},{"url":"https://bugzilla.suse.com/1175660","tags":["report"]},{"url":"https://bugzilla.suse.com/1177508","tags":["report"]},{"url":"https://bugzilla.suse.com/1179579","tags":["report"]},{"url":"https://bugzilla.suse.com/1180224","tags":["report"]},{"url":"https://bugzilla.suse.com/1180439","tags":["report"]},{"url":"https://bugzilla.suse.com/1180547","tags":["report"]},{"url":"https://bugzilla.suse.com/1180558","tags":["report"]},{"url":"https://bugzilla.suse.com/1180757","tags":["report"]},{"url":"https://bugzilla.suse.com/1181048","tags":["report"]},{"url":"https://bugzilla.suse.com/1181165","tags":["report"]},{"url":"https://bugzilla.suse.com/1181228","tags":["report"]},{"url":"https://bugzilla.suse.com/1181290","tags":["report"]},{"url":"https://bugzilla.suse.com/1181416","tags":["report"]},{"url":"https://bugzilla.suse.com/1181423","tags":["report"]},{"url":"https://bugzilla.suse.com/1181635","tags":["report"]},{"url":"https://bugzilla.suse.com/1181807","tags":["report"]},{"url":"https://bugzilla.suse.com/1181814","tags":["report"]},{"url":"https://bugzilla.suse.com/1182001","tags":["report"]},{"url":"https://bugzilla.suse.com/1182006","tags":["report"]},{"url":"https://bugzilla.suse.com/1182008","tags":["report"]},{"url":"https://bugzilla.suse.com/1182071","tags":["report"]},{"url":"https://bugzilla.suse.com/1182200","tags":["report"]},{"url":"https://bugzilla.suse.com/1182492","tags":["report"]},{"url":"https://bugzilla.suse.com/1182685","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-28477","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2020-26258","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4714-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-4943-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-26258","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6978-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-26217","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-26259","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-21341","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-21342","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-21343","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-21344","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-21345","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-21346","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-21347","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-21348","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-21349","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-21350","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-21351","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-3674","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/CTO6QRFLVKVHOYBP6VLJP4KZXZFZSKET/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3674","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7957","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21341","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21342","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21343","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21344","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21345","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21346","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21347","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21348","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21349","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21350","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21351","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-29505","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-39139","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-39144","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-39147","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-39150","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-39153","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2020-26258","title":"Server-Side Forgery Request can be activated unmarshalling with XStream","description":"XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, a Server-Side Forgery Request vulnerability can be activated when unmarshalling. The vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.15. The reported vulnerability does not exist if running Java 15 or higher. No user is affected who followed the recommendation to setup XStream's Security Framework with a whitelist! Anyone relying on XStream's default blacklist can immediately switch to a whilelist for the allowed types to avoid the vulnerability. Users of XStream 1.4.14 or below who still want to use XStream default blacklist can use a workaround described in more detailed in the referenced advisories.","status":"published","published":"2020-12-16T01:05:22Z","modified":"2026-10-07T18:41:30.701Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:35:46.129376Z"}],"euvd":[{"id":"EUVD-2020-1481","description":"XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, a Server-Side Forgery Request vulnerability can be activated when unmarshalling. The vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.15. The reported vulnerability does not exist if running Java 15 or higher. No user is affected who followed the recommendation to setup XStream's Security Framework with a whitelist! Anyone relying on XStream's default blacklist can immediately switch to a whilelist for the allowed types to avoid the vulnerability. Users of XStream 1.4.14 or below who still want to use XStream default blacklist can use a workaround described in more detailed in the referenced advisories.","status":"published","published":"2020-12-16T01:05:22Z","modified":"2026-10-07T18:41:30Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T17:27:34.353796Z"}],"ghsa":[{"id":"GHSA-4cch-wxpw-8p28","title":"Server-Side Forgery Request can be activated unmarshalling with XStream","description":"### Impact\nThe vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream.\n\n### Patches\nIf you rely on XStream's default blacklist of the [Security Framework](https://x-stream.github.io/security.html#framework), you will have to use at least version 1.4.15.\n\n### Workarounds\nThe reported vulnerability does not exist running Java 15 or higher.\n\nNo user is affected, who followed the recommendation to setup XStream's Security Framework with a whitelist! Anyone relying on XStream's default blacklist can immediately switch to a whilelist for the allowed types to avoid the vulnerability.\n\nUsers of XStream 1.4.14 or below who still insist to use XStream default blacklist - despite that clear recommendation - can use a workaround depending on their version in use.\n\nUsers of XStream 1.4.14 can simply add two lines to XStream's setup code:\n```Java\nxstream.denyTypes(new String[]{ \"jdk.nashorn.internal.objects.NativeString\" });\nxstream.denyTypesByRegExp(new String[]{ \".*\\\\.ReadAllStream\\\\$FileStream\" });\n```\n\nUsers of XStream 1.4.14 to 1.4.13 can simply add three lines to XStream's setup code:\n```Java\nxstream.denyTypes(new String[]{ \"javax.imageio.ImageIO$ContainsFilter\", \"jdk.nashorn.internal.objects.NativeString\" });\nxstream.denyTypes(new Class[]{ java.lang.ProcessBuilder.class });\nxstream.denyTypesByRegExp(new String[]{ \".*\\\\.ReadAllStream\\\\$FileStream\" });\n```\nUsers of XStream 1.4.12 to 1.4.7 who want to use XStream with a black list will have to setup such a list from scratch and deny at least the following types: _javax.imageio.ImageIO$ContainsFilter_, _java.beans.EventHandler_, _java.lang.ProcessBuilder_, _jdk.nashorn.internal.objects.NativeString.class_, _java.lang.Void_ and _void_ and deny several types by name pattern.\n```Java\nxstream.denyTypes(new String[]{ \"javax.imageio.ImageIO$ContainsFilter\", \"jdk.nashorn.internal.objects.NativeString\" });\nxstream.denyTypes(new Class[]{ java.lang.ProcessBuilder.class, \"jdk.nashorn.internal.objects.NativeString\", java.beans.EventHandler.class, java.lang.ProcessBuilder.class, java.lang.Void.class, void.class });\nxstream.denyTypesByRegExp(new String[]{ \".*\\\\$LazyIterator\", \"javax\\\\.crypto\\\\..*\", \".*\\\\.ReadAllStream\\\\$FileStream\" });\n```\nUsers of XStream 1.4.6 or below can register an own converter to prevent the unmarshalling of the currently know critical types of the Java runtime. It is in fact an updated version of the workaround for CVE-2013-7285:\n```Java\nxstream.registerConverter(new Converter() {\n  public boolean canConvert(Class type) {\n    return type != null \u0026\u0026 (type == java.beans.EventHandler.class || type == java.lang.ProcessBuilder.class\n        || type.getName().equals(\"javax.imageio.ImageIO$ContainsFilter\") || type.getName().equals(\"jdk.nashorn.internal.objects.NativeString\")\n        || type == java.lang.Void.class || void.class || Proxy.isProxy(type))\n        || type.getName().startsWith(\"javax.crypto.\") || type.getName().endsWith(\"$LazyIterator\") || type.getName().endsWith(\".ReadAllStream$FileStream\"));\n  }\n\n  public Object unmarshal(HierarchicalStreamReader reader, UnmarshallingContext context) {\n    throw new ConversionException(\"Unsupported type due to security reasons.\");\n  }\n\n  public void marshal(Object source, HierarchicalStreamWriter writer, MarshallingContext context) {\n    throw new ConversionException(\"Unsupported type due to security reasons.\");\n  }\n}, XStream.PRIORITY_LOW);\n```\n \n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [XStream](https://github.com/x-stream/xstream/issues)\n* Contact us at [XStream Google Group](https://groups.google.com/group/xstream-user)","status":"published","published":"2020-12-21T16:28:42Z","modified":"2025-01-15T21:32:40Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:38:27.067633Z"}],"nvd":[{"id":"CVE-2020-26258","description":"XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, a Server-Side Forgery Request vulnerability can be activated when unmarshalling. The vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.15. The reported vulnerability does not exist if running Java 15 or higher. No user is affected who followed the recommendation to setup XStream's Security Framework with a whitelist! Anyone relying on XStream's default blacklist can immediately switch to a whilelist for the allowed types to avoid the vulnerability. Users of XStream 1.4.14 or below who still want to use XStream default blacklist can use a workaround described in more detailed in the referenced advisories.","status":"published","published":"2020-12-16T01:15:12.333Z","modified":"2026-10-07T19:17:17.51Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:06:27.73474Z"}],"osv":[{"id":"CVE-2020-26258","description":"XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, a Server-Side Forgery Request vulnerability can be activated when unmarshalling. The vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.15. The reported vulnerability does not exist if running Java 15 or higher. No user is affected who followed the recommendation to setup XStream's Security Framework with a whitelist! Anyone relying on XStream's default blacklist can immediately switch to a whilelist for the allowed types to avoid the vulnerability. Users of XStream 1.4.14 or below who still want to use XStream default blacklist can use a workaround described in more detailed in the referenced advisories.","status":"published","published":"2020-12-16T01:15:12.333Z","modified":"2026-10-24T10:50:22.94902149Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:15.879068Z"},{"id":"DEBIAN-CVE-2020-26258","description":"XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, a Server-Side Forgery Request vulnerability can be activated when unmarshalling. The vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.15. The reported vulnerability does not exist if running Java 15 or higher. No user is affected who followed the recommendation to setup XStream's Security Framework with a whitelist! Anyone relying on XStream's default blacklist can immediately switch to a whilelist for the allowed types to avoid the vulnerability. Users of XStream 1.4.14 or below who still want to use XStream default blacklist can use a workaround described in more detailed in the referenced advisories.","status":"published","published":"2020-12-16T01:15:12.333Z","modified":"2026-10-26T12:01:06.344995588Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:33.729655Z"},{"id":"GHSA-4cch-wxpw-8p28","title":"Server-Side Forgery Request can be activated unmarshalling with XStream","description":"### Impact\nThe vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream.\n\n### Patches\nIf you rely on XStream's default blacklist of the [Security Framework](https://x-stream.github.io/security.html#framework), you will have to use at least version 1.4.15.\n\n### Workarounds\nThe reported vulnerability does not exist running Java 15 or higher.\n\nNo user is affected, who followed the recommendation to setup XStream's Security Framework with a whitelist! Anyone relying on XStream's default blacklist can immediately switch to a whilelist for the allowed types to avoid the vulnerability.\n\nUsers of XStream 1.4.14 or below who still insist to use XStream default blacklist - despite that clear recommendation - can use a workaround depending on their version in use.\n\nUsers of XStream 1.4.14 can simply add two lines to XStream's setup code:\n```Java\nxstream.denyTypes(new String[]{ \"jdk.nashorn.internal.objects.NativeString\" });\nxstream.denyTypesByRegExp(new String[]{ \".*\\\\.ReadAllStream\\\\$FileStream\" });\n```\n\nUsers of XStream 1.4.14 to 1.4.13 can simply add three lines to XStream's setup code:\n```Java\nxstream.denyTypes(new String[]{ \"javax.imageio.ImageIO$ContainsFilter\", \"jdk.nashorn.internal.objects.NativeString\" });\nxstream.denyTypes(new Class[]{ java.lang.ProcessBuilder.class });\nxstream.denyTypesByRegExp(new String[]{ \".*\\\\.ReadAllStream\\\\$FileStream\" });\n```\nUsers of XStream 1.4.12 to 1.4.7 who want to use XStream with a black list will have to setup such a list from scratch and deny at least the following types: _javax.imageio.ImageIO$ContainsFilter_, _java.beans.EventHandler_, _java.lang.ProcessBuilder_, _jdk.nashorn.internal.objects.NativeString.class_, _java.lang.Void_ and _void_ and deny several types by name pattern.\n```Java\nxstream.denyTypes(new String[]{ \"javax.imageio.ImageIO$ContainsFilter\", \"jdk.nashorn.internal.objects.NativeString\" });\nxstream.denyTypes(new Class[]{ java.lang.ProcessBuilder.class, \"jdk.nashorn.internal.objects.NativeString\", java.beans.EventHandler.class, java.lang.ProcessBuilder.class, java.lang.Void.class, void.class });\nxstream.denyTypesByRegExp(new String[]{ \".*\\\\$LazyIterator\", \"javax\\\\.crypto\\\\..*\", \".*\\\\.ReadAllStream\\\\$FileStream\" });\n```\nUsers of XStream 1.4.6 or below can register an own converter to prevent the unmarshalling of the currently know critical types of the Java runtime. It is in fact an updated version of the workaround for CVE-2013-7285:\n```Java\nxstream.registerConverter(new Converter() {\n  public boolean canConvert(Class type) {\n    return type != null \u0026\u0026 (type == java.beans.EventHandler.class || type == java.lang.ProcessBuilder.class\n        || type.getName().equals(\"javax.imageio.ImageIO$ContainsFilter\") || type.getName().equals(\"jdk.nashorn.internal.objects.NativeString\")\n        || type == java.lang.Void.class || void.class || Proxy.isProxy(type))\n        || type.getName().startsWith(\"javax.crypto.\") || type.getName().endsWith(\"$LazyIterator\") || type.getName().endsWith(\".ReadAllStream$FileStream\"));\n  }\n\n  public Object unmarshal(HierarchicalStreamReader reader, UnmarshallingContext context) {\n    throw new ConversionException(\"Unsupported type due to security reasons.\");\n  }\n\n  public void marshal(Object source, HierarchicalStreamWriter writer, MarshallingContext context) {\n    throw new ConversionException(\"Unsupported type due to security reasons.\");\n  }\n}, XStream.PRIORITY_LOW);\n```\n \n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [XStream](https://github.com/x-stream/xstream/issues)\n* Contact us at [XStream Google Group](https://groups.google.com/group/xstream-user)","status":"published","published":"2020-12-21T16:28:42Z","modified":"2026-09-10T03:49:00.699163166Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T15:46:36.782754Z"},{"id":"OESA-2021-1015","title":"xstream security update","description":"XStream is a simple library to serialize objects to XML and back again. A high level facade is supplied that simplifies common use cases. Custom objects can be serialized without need for specifying mappings. Speed and low memory footprint are a crucial part of the design, making it suitable for large object graphs or systems with high message throughput. No information is duplicated that can be obtained via reflection. This results in XML that is easier to read for humans and more compact than native Java serialization. XStream serializes internal fields, including private and final. Supports non-public and inner classes. Classes are not required to have default constructor. Duplicate references encountered in the object-model will be maintained. Supports circular references. By implementing an interface, XStream can serialize directly to/from any tree structure (not just XML). Strategies can be registered allowing customization of how particular types are represented as XML. When an exception occurs due to malformed XML, detailed diagnostics are provided to help isolate and fix the problem.\\r\\n\\r\\n\r\nSecurity Fix(es):\\r\\n\\r\\n\r\nXStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, a Server-Side Forgery Request vulnerability can be activated when unmarshalling. The vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.15. The reported vulnerability does not exist if running Java 15 or higher. No user is affected who followed the recommendation to setup XStream's Security Framework with a whitelist! Anyone relying on XStream's default blacklist can immediately switch to a whilelist for the allowed types to avoid the vulnerability. Users of XStream 1.4.14 or below who still want to use XStream default blacklist can use a workaround described in more detailed in the referenced advisories.(CVE-2020-26258)\\r\\n\\r\\n\r\nXStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling. The vulnerability may allow a remote attacker to delete arbitrary know files on the host as log as the executing process has sufficient rights only by manipulating the processed input stream. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.15. The reported vulnerability does not exist running Java 15 or higher. No user is affected, who followed the recommendation to setup XStream's Security Framework with a whitelist! Anyone relying on XStream's default blacklist can immediately switch to a whilelist for the allowed types to avoid the vulnerability. Users of XStream 1.4.14 or below who still want to use XStream default blacklist can use a workaround described in more detailed in the referenced advisories.(CVE-2020-26259)\\r\\n\\r\\n","status":"published","published":"2021-02-04T11:04:14Z","modified":"2026-08-18T01:15:06.081916087Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:38.987987Z"},{"id":"UBUNTU-CVE-2020-26258","description":"XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, a Server-Side Forgery Request vulnerability can be activated when unmarshalling. The vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.15. The reported vulnerability does not exist if running Java 15 or higher. No user is affected who followed the recommendation to setup XStream's Security Framework with a whitelist! Anyone relying on XStream's default blacklist can immediately switch to a whilelist for the allowed types to avoid the vulnerability. Users of XStream 1.4.14 or below who still want to use XStream default blacklist can use a workaround described in more detailed in the referenced advisories.","status":"published","published":"2020-12-16T01:15:00Z","modified":"2026-02-04T04:39:54.340864Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"high"},{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:23.905183Z"},{"id":"DLA-2507-1","title":"libxstream-java - security update","status":"published","published":"2020-12-31T00:00:00Z","modified":"2026-03-09T01:19:43.412885Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"DSA-4828-1","title":"libxstream-java - security update","status":"published","published":"2021-01-07T00:00:00Z","modified":"2026-03-09T02:11:33.406446Z","updated_at":"2026-11-02T15:46:17.19998Z"},{"id":"openSUSE-SU-2021:0140-1","title":"Security update for xstream","description":"This update for xstream fixes the following issues:\n\nxstream was updated to version 1.4.15.\n\n- CVE-2020-26217: Fixed a remote code execution due to insecure XML deserialization when relying on blocklists (bsc#1180994).\n- CVE-2020-26258: Fixed a server-side request forgery vulnerability (bsc#1180146).\n- CVE-2020-26259: Fixed an arbitrary file deletion vulnerability (bsc#1180145).\n\nThis update was imported from the SUSE:SLE-15-SP2:Update update project.","status":"published","published":"2021-01-22T16:22:21Z","modified":"2026-02-04T03:04:16.463536Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2024:10592-1","title":"xstream-1.4.18-1.1 on GA media","description":"These are all security issues fixed in the xstream-1.4.18-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:40:43.193438Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-SU-2021:0176-1","title":"Security update for xstream","description":"This update for xstream fixes the following issues:\n\nxstream was updated to version 1.4.15.\n\n- CVE-2020-26217: Fixed a remote code execution due to insecure XML deserialization when relying on blocklists (bsc#1180994).\n- CVE-2020-26258: Fixed a server-side request forgery vulnerability (bsc#1180146).\n- CVE-2020-26259: Fixed an arbitrary file deletion vulnerability (bsc#1180145).\n","status":"published","published":"2021-01-20T08:49:09Z","modified":"2026-02-04T02:56:24.28293Z","updated_at":"2026-11-02T15:53:48.690034Z"},{"id":"SUSE-SU-2021:0906-1","title":"Security update for SUSE Manager Server 4.1","description":"This update fixes the following issues:\n\ncobbler:\n\n- Fix string replacement for @@xyz@@\n- Better performing string replacements\n\ngrafana-formula:\n\n- Set `supported` to false for unsupported systems (bsc#1182001)\n- Add SLES 15 SP3 and openSUSE Leap 15.3 to supported versions\n\nmgr-libmod:\n\n- Fix 'list_modules' JSON serialization (bsc#1182492)\n\nmgr-osad:\n\n- Adapt to new SSL implementation of rhnlib (bsc#1181807)\n\nprometheus-exporters-formula:\n\n- Add Ubuntu support for Prometheus exporters' reverse proxy\n\nprometheus-formula:\n\n- Set server hostname from pillar data (bsc#1180439)\n\npy26-compat-salt:\n\n- Do not crash when unexpected cmd output at listing patches (bsc#1181290)\n\nrhnlib:\n\n- Change SSL implementation to python ssl for better SAN and\n  hostname matching support (bsc#1181807)\n\nsmdba:\n\n- Do not remove the database if there is no backup and deal with manifest\n\nspacewalk-backend:\n\n- Open repomd files as binary (bsc#1173893)\n- Fix requesting Release file in debian repos (bsc#1182006)\n- Reposync: Fixed Kickstart functionality.\n- Reposync: Fixed URLGrabber error handling.\n- Reposync: Fix modular data handling for cloned channels (bsc#1177508)\n\nspacewalk-client-tools:\n\n- Adapt to new SSL implementation of rhnlib (bsc#1181807)\n\nspacewalk-config:\n\n- Increase apache ssl logs to include response code and process time\n\nspacewalk-java:\n\n- Homogenizes style in filter buttons, facilitating testability\n- Cleanup sessions via SQL query instead of SQL function (bsc#1180224)\n- Rebuild and improve rendering of error pages 404 and 500 pages (bsc#1181228)\n- Fix user creation with pam auth and no password (bsc#1179579)\n- Fix action chains for saltssh minions (bsc#1182200)\n- FIX: Slow response of 'Software \u003e Install' in Ubuntu minions (bsc#1181165)\n- Do not call page decorator in HEAD requests (bsc#1181228)\n- Add 'mgr_origin_server' to Salt pillar data (bsc#1180439)\n- Ensure new files are synced just after writing them (bsc#1175660)\n- Enable openscap auditing for salt systems in SSM (bsc#1157711)\n- Detect debian products (bsc#1181416)\n- Show packages from channels assigned to the targeted system (bsc#1181423)\n- Add an API endpoint to allow/disallow scheduling irrelevant patches (bsc#1180757)\n- Open raw output in new tab for ScriptRunAction (bsc#1180547)\n- Default to preferred items per page in content lifecycle lists (bsc#1180558)\n- Fix modular data handling for cloned channels (bsc#1177508)\n- Fix: login gets an ISE when SSO is enabled (bsc#1181048)\n\nspacewalk-utils:\n\n- Fix modular data handling for cloned channels (bsc#1177508)\n\nspacewalk-web:\n\n- Replace CRLF in ssh priv key when bootstrapping (bsc#1182685)\n- Upgrade immer to fix CVE-2020-28477\n- Default to preferred items per page in content lifecycle lists (bsc#1180558)\n- Fix sorting in content lifecycle projects and cluster tables (bsc#1180558)\n\nsusemanager:\n\n- Add SLE 15 SP3 bootstrap repository definitions (bsc#1182008)\n- Python3-dbus-python and dependencies not installed by default\n  on JeOS SLE15 images, add them to the bootstrap repository list\n  of packages for traditional (bsc#1182071)\n\nsusemanager-doc-indexes:\n\n- Updated Command Line Registration with Salt section in the Client\n  Configuration Guide for clarity.\n- Adds openSUSE Leap SP migration to the SP migration section of the Client\n  Configuration Guide\n- Adds note that bootstrap procedure for selecting a parent\n  channel is optional in Client Configuration Guide (bsc#1181635)\n- Adds note about checking for valid UUIDs in fstab\n  when backing up (bsc#1181814)\n- Updated command for running configure proxy script when replacing a proxy\n- Fixed bad SUSE Customer Center URL\n\nsusemanager-docs_en:\n\n- Updated Command Line Registration with Salt section in the Client\n  Configuration Guide for clarity.\n- Adds openSUSE Leap SP migration to the SP migration section of the Client\n  Configuration Guide\n- Adds note that bootstrap procedure for selecting a parent\n  channel is optional in Client Configuration Guide (bsc#1181635)\n- Adds note about checking for valid UUIDs in fstab\n  when backing up (bsc#1181814)\n- Updated command for running configure proxy script when replacing a proxy\n- Fixed bad SUSE Customer Center URL\n\nsusemanager-schema:\n\n- Drop 'pxt_session_cleanup' function (bsc#1180224)\n- Enable openscap auditing for salt systems in SSM (bsc#1157711)\n\nsusemanager-sls:\n\n- Ubuntu 18 has version of apt which does not correctly support\n  auth.conf.d directory. Detect the working version and use this feature\n  only when we have a higher version installed\n\nxstream:\n\nUpgrade to 1.4.15\n\n- fixes bsc#1180146, CVE-2020-26258 and bsc#1180145, CVE-2020-26259\n- fixes bsc#1180994, CVE-2020-26217\n\nsubscription-matcher:\n\n- Update the xstream dependency to 1.4.15\n\nHow to apply this update:\n1. Log in as root user to the SUSE Manager server.\n2. Stop the Spacewalk service:\n`spacewalk-service stop`\n3. Apply the patch using either zypper patch or YaST Online Update.\n4. Start the Spacewalk service:\n`spacewalk-service start`\n","status":"published","published":"2021-03-19T15:18:39Z","modified":"2026-02-04T02:16:30.339534Z","updated_at":"2026-11-02T15:53:48.690034Z"},{"id":"USN-4714-1","title":"libxstream-java vulnerabilities","description":"Zhihong Tian and Hui Lu found that XStream was vulnerable to remote code\nexecution. A remote attacker could run arbitrary shell commands by\nmanipulating the processed input stream. (CVE-2020-26217)\n\nIt was discovered that XStream was vulnerable to server-side forgery attacks.\nA remote attacker could request data from internal resources that are not\npublicly available only by manipulating the processed input stream.\n(CVE-2020-26258)\n\nIt was discovered that XStream was vulnerable to arbitrary file deletion on\nthe local host. A remote attacker could use this to delete arbitrary known\nfiles on the host as long as the executing process had sufficient rights only\nby manipulating the processed input stream. (CVE-2020-26259)\n","status":"published","published":"2021-01-28T20:38:34Z","modified":"2026-02-10T04:42:02Z","updated_at":"2026-11-02T16:58:15.159055Z"},{"id":"USN-4943-1","title":"libxstream-java vulnerabilities","description":"Zhihong Tian and Hui Lu found that XStream was vulnerable to remote code\nexecution. A remote attacker could run arbitrary shell commands by\nmanipulating the processed input stream. This issue affected only affected\nUbuntu 20.10. (CVE-2020-26217)\n\nIt was discovered that XStream was vulnerable to server-side forgery attacks.\nA remote attacker could request data from internal resources that are not\npublicly available only by manipulating the processed input stream. This\nissue only affected Ubuntu 20.10. (CVE-2020-26258)\n\nIt was discovered that XStream was vulnerable to arbitrary file deletion on\nthe local host. A remote attacker could use this to delete arbitrary known\nfiles on the host as long as the executing process had sufficient rights only\nby manipulating the processed input stream. This issue only affected\nUbuntu 20.10. (CVE-2020-26259)\n\nIt was discovered that XStream was vulnerable to denial of service,\narbitrary code execution, arbitrary file deletion and server-side forgery\nattacks. A remote attacker could cause any of those issues by manipulating\nthe processed input stream. (CVE-2021-21341, CVE-2021-21342, CVE-2021-21343\nCVE-2021-21344, CVE-2021-21345, CVE-2021-21346, CVE-2021-21347,\nCVE-2021-21348, CVE-2021-21349, CVE-2021-21350, CVE-2021-21351)\n","status":"published","published":"2021-05-11T09:41:13Z","modified":"2026-04-27T16:03:36.609273828Z","updated_at":"2026-11-02T16:58:15.159055Z"},{"id":"USN-6978-1","title":"libxstream-java vulnerabilities","description":"It was discovered that XStream incorrectly handled parsing of certain\ncrafted XML documents. A remote attacker could possibly use this issue to\nread arbitrary files. (CVE-2016-3674)\n\nZhihong Tian and Hui Lu found that XStream was vulnerable to remote code\nexecution. A remote attacker could run arbitrary shell commands by\nmanipulating the processed input stream. (CVE-2020-26217)\n\nIt was discovered that XStream was vulnerable to server-side forgery\nattacks. A remote attacker could request data from internal resources\nthat are not publicly available only by manipulating the processed input\nstream. (CVE-2020-26258)\n\nIt was discovered that XStream was vulnerable to arbitrary file deletion\non the local host. A remote attacker could use this to delete arbitrary\nknown files on the host as long as the executing process had sufficient\nrights only by manipulating the processed input stream. (CVE-2020-26259)\n\nIt was discovered that XStream was vulnerable to denial of service,\narbitrary code execution, arbitrary file deletion and server-side forgery\nattacks. A remote attacker could cause any of those issues by\nmanipulating the processed input stream. (CVE-2021-21341, CVE-2021-21342,\nCVE-2021-21343, CVE-2021-21344, CVE-2021-21345, CVE-2021-21346,\nCVE-2021-21347, CVE-2021-21348, CVE-2021-21349, CVE-2021-21350,\nCVE-2021-21351)\n","status":"published","published":"2024-08-22T15:18:01Z","modified":"2026-06-29T13:51:15.787793258Z","updated_at":"2026-11-02T16:58:18.876384Z"}]}}