Geoserver is using a version of Xstream that has known vulnerabilities

Description

Geoserver is using a version of Xstream that has known vulnerabilities, not sure if this makes GeoServer vulnerable or not, but upgrading is easy enough.

CVE-2013-7285

Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. e.g. JSON.

CVE-2019-10173

It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw. If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when unmarshalling XML or any supported format. e.g. JSON. (regression of CVE-2013-7285)

Environment

None

Activity

Former user 
August 23, 2019 at 3:15 PM

started upgrade in

Andrea Aime 
August 21, 2019 at 11:57 AM

A note for the reader, GeoServer normally uses SecureXStream, a subclass that initializes the security framework, so it should not be affected by those two CVE.

Fixed

Details

Assignee

Reporter

Fix versions

Priority

Created August 21, 2019 at 11:09 AM
Updated October 18, 2021 at 2:59 PM
Resolved October 20, 2019 at 1:45 PM