It was found that Remote code execution (RCE) is possible in XStream prior to 1.4.14 via unsafe deserialization of user supplied XML in conjunction with relying on the default XStream deny list, a remote attacker could use this flaw to perform a variety of attacks but principally this is arbitrary code execution in the context of the JVM running the XStream application. Upstream Advisory: https://github.com/x-stream/xstream/security/advisories/GHSA-mw36-7c6c-q4q2 Upstream Fix: https://github.com/x-stream/xstream/commit/0fec095d534126931c99fd38e9c6d41f5c685c1a Upstream explanation and PoC: https://x-stream.github.io/CVE-2020-26217.html
Created xstream tracking bugs for this issue: Affects: fedora-all [bug 1898944]
This vulnerability is out of security support scope for the following products: * Red Hat JBoss Fuse Service Works 6 Please refer to https://access.redhat.com/support/policy/updates/jboss_notes for more details.
Mitigation: Depending on the version of XStream used there are various usage patterns that mitigate this flaw, though we would strongly recommend using the allow list approach if at all possible as there are likely more class combinations the deny list approach may not address. Allow list approach ```java XStream xstream = new XStream(); XStream.setupDefaultSecurity(xstream); xstream.allowTypesByWildcard(new String[] {"com.misc.classname"}) ``` Deny list for XStream 1.4.13 ```java xstream.denyTypes(new String[]{ "javax.imageio.ImageIO$ContainsFilter" }); xstream.denyTypes(new Class[]{ java.lang.ProcessBuilder.class }); ``` Deny list for XStream 1.4.7 -> 1.4.12 ```java xstream.denyTypes(new String[]{ "javax.imageio.ImageIO$ContainsFilter" }); xstream.denyTypes(new Class[]{ java.lang.ProcessBuilder.class, java.beans.EventHandler.class, java.lang.ProcessBuilder.class, java.lang.Void.class, void.class }); ``` Deny list for versions prior to XStream 1.4.7 ```java xstream.registerConverter(new Converter() { public boolean canConvert(Class type) { return type != null && (type == java.beans.EventHandler.class || type == java.lang.ProcessBuilder.class || type == java.lang.Void.class || void.class || type.getName().equals("javax.imageio.ImageIO$ContainsFilter") || Proxy.isProxy(type)); } public Object unmarshal(HierarchicalStreamReader reader, UnmarshallingContext context) { throw new ConversionException("Unsupported type due to security reasons."); } public void marshal(Object source, HierarchicalStreamWriter writer, MarshallingContext context) { throw new ConversionException("Unsupported type due to security reasons."); } }, XStream.PRIORITY_LOW); ```
Marking Red Hat JBoss Fuse 6, Red Hat Fuse 7, Red Hat Intergration Camel K as Moderate, although these products use vulnerable versions of XStream through the camel-xstream component https://access.redhat.com/documentation/en-us/red_hat_jboss_fuse/6.3/html/apache_camel_component_reference/idu-xstream Camel provides an extended default deny list with `org.apache.camel.xstream.permissions`, the default being `-,java.lang.,java.util.`, for this reason the attack complexity is significantly increased as this deny list is out of the attackers control. Users overriding the org.apache.camel.xstream.permissions for unmarshalling of XML should ensure either both `-javax.imageio.ImageIO.` and `-java.lang.ProcessBuilder.` are explicitly present or all classes are denied by default eg. `-*,com.misc.mypacakge.myclass`.
Statement: OpenShift Container Platform (OCP) delivers jenkins package with bundled XStream library. Due to JEP-200 Jenkins project [1] and advisory SECURITY-383 [2], OCP jenkins package is not affected by this flaw. [1] https://github.com/jenkinsci/jep/blob/master/jep/200/README.adoc [2] https://www.jenkins.io/security/advisory/2017-02-01/ (see SECURITY-383 / CVE-2017-2608)
This issue has been addressed in the following products: RHDM 7.9.1 Via RHSA-2021:0106 https://access.redhat.com/errata/RHSA-2021:0106
This issue has been addressed in the following products: RHPAM 7.9.1 Via RHSA-2021:0105 https://access.redhat.com/errata/RHSA-2021:0105
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2020-26217
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2021:0162 https://access.redhat.com/errata/RHSA-2021:0162
This issue has been addressed in the following products: Red Hat Fuse/AMQ 6.3.18 Via RHSA-2021:0384 https://access.redhat.com/errata/RHSA-2021:0384
This issue has been addressed in the following products: Red Hat Data Grid 8.1.1 Via RHSA-2021:0433 https://access.redhat.com/errata/RHSA-2021:0433
This issue has been addressed in the following products: Red Hat Integration Via RHSA-2021:4767 https://access.redhat.com/errata/RHSA-2021:4767
This issue has been addressed in the following products: Red Hat Fuse 7.10 Via RHSA-2021:5134 https://access.redhat.com/errata/RHSA-2021:5134