Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.
First Last Prev Next    This bug is not in your last search results.
Bug 1508123 - (CVE-2016-5003) CVE-2016-5003 xmlrpc: Deserialization of untrusted Java object through <ex:serializable> tag
CVE-2016-5003 xmlrpc: Deserialization of untrusted Java object through <ex:se...
Status: NEW
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
high Severity high
: ---
: ---
Assigned To: Red Hat Product Security
impact=important,public=20160524,repo...
: Security
Depends On: 1578874 1508124 1578873 1578875 1578876 1578877 1578878 1594618
Blocks: 1508328
  Show dependency tree / graph
 
Reported: 2017-10-31 16:35 EDT by Pedro Sampaio
Modified: 2018-08-18 07:28 EDT (History)
26 users (show)

See Also:
Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
A flaw was discovered in the Apache XML-RPC (ws-xmlrpc) library that deserializes untrusted data when enabledForExtensions setting is enabled. A remote attacker could use this vulnerability to execute arbitrary code via a crafted serialized Java object in a <ex:serializable> element.
Story Points: ---
Clone Of:
Environment:
Last Closed:
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)
Add an attachment (proposed patch, testcase, etc.)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2018:1779 None None None 2018-05-31 12:39 EDT
Red Hat Product Errata RHSA-2018:1780 None None None 2018-05-31 17:09 EDT
Red Hat Product Errata RHSA-2018:1784 None None None 2018-06-04 06:48 EDT
Red Hat Product Errata RHSA-2018:2317 None None None 2018-07-31 13:49 EDT

  None (edit)
Description Pedro Sampaio 2017-10-31 16:35:45 EDT 
The Apache XML-RPC (aka ws-xmlrpc) library 3.1.3, as used in Apache Archiva, allows remote attackers to execute arbitrary code via a crafted serialized Java object in an <ex:serializable> element. 

References:

http://www.openwall.com/lists/oss-security/2016/07/12/5
https://0ang3el.blogspot.in/2016/07/beware-of-ws-xmlrpc-library-in-your.html
Comment 1 Pedro Sampaio 2017-10-31 16:36:27 EDT 
Created xmlrpc tracking bugs for this issue:

Affects: fedora-all [bug 1508124]
Comment 6 Riccardo Schirone 2018-05-14 04:25:33 EDT 
Mitigation:

Setting enabledForExtensions is false by default, thus <ex:serializable> elements are not automatically deserialized. However, if you have it enabled and you don't need any of the provided functions (https://ws.apache.org/xmlrpc/extensions.html) we suggest you disable it.
Comment 8 errata-xmlrpc 2018-05-31 12:38:57 EDT 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2018:1779 https://access.redhat.com/errata/RHSA-2018:1779
Comment 9 errata-xmlrpc 2018-05-31 17:09:12 EDT 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2018:1780 https://access.redhat.com/errata/RHSA-2018:1780
Comment 10 errata-xmlrpc 2018-06-04 06:48:42 EDT 
This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 6
  Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 7.3 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS

Via RHSA-2018:1784 https://access.redhat.com/errata/RHSA-2018:1784
Comment 11 Doran Moppert 2018-06-24 22:23:23 EDT 
This vulnerability can also affect xmlrpc clients, if they may be used against untrusted servers.
Comment 13 errata-xmlrpc 2018-07-31 13:49:07 EDT 
This issue has been addressed in the following products:

  Red Hat Virtualization 4 for Red Hat Enterprise Linux 7

Via RHSA-2018:2317 https://access.redhat.com/errata/RHSA-2018:2317
Note You need to log in before you can comment on or make changes to this bug.
First Last Prev Next    This bug is not in your last search results.