lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-Id: <E1izojU-0004GS-9x@seger.debian.org> Date: Thu, 06 Feb 2020 21:30:44 +0000 From: Salvatore Bonaccorso <carnil@...ian.org> To: bugtraq@...urityfocus.com Subject: [SECURITY] [DSA 4619-1] libxmlrpc3-java security update -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-4619-1 security@...ian.org https://www.debian.org/security/ Salvatore Bonaccorso February 06, 2020 https://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : libxmlrpc3-java CVE ID : CVE-2019-17570 Debian Bug : 949089 Guillaume Teissier reported that the XMLRPC client in libxmlrpc3-java, an XML-RPC implementation in Java, does perform deserialization of the server-side exception serialized in the faultCause attribute of XMLRPC error response messages. A malicious XMLRPC server can take advantage of this flaw to execute arbitrary code with the privileges of an application using the Apache XMLRPC client library. Note that a client that expects to get server-side exceptions need to set explicitly the enabledForExceptions property. For the oldstable distribution (stretch), this problem has been fixed in version 3.1.3-8+deb9u1. For the stable distribution (buster), this problem has been fixed in version 3.1.3-9+deb10u1. We recommend that you upgrade your libxmlrpc3-java packages. For the detailed security status of libxmlrpc3-java please refer to its security tracker page at: https://security-tracker.debian.org/tracker/libxmlrpc3-java Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@...ts.debian.org -----BEGIN PGP SIGNATURE----- iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAl48hNhfFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2 NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND z0TKMQ//VAIMT+y/PGlPLV5C2P82ZxHCNwKYwkPT7s9nI/jvqVH5CkL0kGjvW5Ng eFpZTW6hPMboDrUkSltRTawlYlwlMP1am8whOEL7EwZXYi5s3iixSZCI8lafDDT7 VyQ+ELFu0y5Y+WZtECvdZDLDVzWggCW+ZeQFK9WRFT32GrevAb/BFyDlHMGKREFq m9iQQ8D4+dPqOnF/RecCiohITV2++AECr8x4WzOHq/QCkYl/5PbQlZ9JGA1unDTC dt5wsjWLUGmwEW0Iy9h0AzlvuMfGnQ/5KkOu1ZfYwf2c5V7FXEg+Jj7M3ai+X+9f 6pcj+FyAUBD2dgS8psKSO4LbtGYDt826HZ/KxAp7W6gd5v1l3kEzKQsAsvQwaaxi X68AgwkXs94X1yiAAjAdAFc7js1aJr+1/aSzN0JP7jWX1SjWmLquEolKuOQF2pH2 enFo/TQixaLGrs3h5Oh41+a0i4kSBqxV1LiNMLaI9k8lOMlMaadJtkCF6umHh7SX bACOeVlVS25vnk/Bn9xgr5JyPTQdeR8VfZVgld2N5vOlfNIrRJcy/mqJfv5OmuG8 kTIsFP/ON/NMuyvDy6xfY3B+cVZzw9K2hmD41k6oRcaKjvYqWToDXZSaNT+wzHcc aqbVSHlL/jS7+1gRFsCX50p/JmtLGhlZtCF0FXhLamM7glyhLXk= =lpO+ -----END PGP SIGNATURE-----
Powered by blists - more mailing lists