Bug 1508123 (CVE-2016-5003)
| Summary: | CVE-2016-5003 xmlrpc: Deserialization of untrusted Java object through <ex:serializable> tag | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Pedro Sampaio <psampaio> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | bmcclain, dbhole, dblechte, dmoppert, dwalluck, eedri, hhorak, java-maint, java-sig-commits, jorton, krzysztof.daniel, mgoldboi, michal.skrivanek, mizdebsk, puntogil, sbonazzo, sherold, sisharma, sochotni, ssaha, vbellur, ykaul, yozone |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: |
A flaw was discovered in the Apache XML-RPC (ws-xmlrpc) library that deserializes untrusted data when enabledForExtensions setting is enabled. A remote attacker could use this vulnerability to execute arbitrary code via a crafted serialized Java object in a <ex:serializable> element.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2019-06-08 03:30:11 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1508124, 1578873, 1578874, 1578875, 1578876, 1578877, 1578878, 1594618 | ||
| Bug Blocks: | 1508328 | ||
|
Description
Pedro Sampaio
2017-10-31 20:35:45 UTC
Created xmlrpc tracking bugs for this issue: Affects: fedora-all [bug 1508124] Mitigation: Setting enabledForExtensions is false by default, thus <ex:serializable> elements are not automatically deserialized. However, if you have it enabled and you don't need any of the provided functions (https://ws.apache.org/xmlrpc/extensions.html) we suggest you disable it. This issue has been addressed in the following products: Red Hat Enterprise Linux 6 Via RHSA-2018:1779 https://access.redhat.com/errata/RHSA-2018:1779 This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2018:1780 https://access.redhat.com/errata/RHSA-2018:1780 This issue has been addressed in the following products: Red Hat Software Collections for Red Hat Enterprise Linux 6 Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7 Red Hat Software Collections for Red Hat Enterprise Linux 7.3 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS Via RHSA-2018:1784 https://access.redhat.com/errata/RHSA-2018:1784 This vulnerability can also affect xmlrpc clients, if they may be used against untrusted servers. This issue has been addressed in the following products: Red Hat Virtualization 4 for Red Hat Enterprise Linux 7 Via RHSA-2018:2317 https://access.redhat.com/errata/RHSA-2018:2317 This issue has been addressed in the following products: Red Hat Fuse 7.2 Via RHSA-2018:3768 https://access.redhat.com/errata/RHSA-2018:3768 |