Geoserver is using a version of Xstream that has known vulnerabilities

Description

Geoserver is using a version of Xstream that has known vulnerabilities, not sure if this makes GeoServer vulnerable or not, but upgrading is easy enough.

CVE-2013-7285

Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. e.g. JSON.

CVE-2019-10173

It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw. If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when unmarshalling XML or any supported format. e.g. JSON. (regression of CVE-2013-7285)

Environment

None

Status

Assignee

Unassigned

Reporter

Mark Prins

Triage

None

Fix versions

Affects versions

2.15.2
2.15.3
2.16.0
2.16-RC

Priority

High
Configure