oss-security - CVE request: remote code execution via deserialization in XStream

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <52CF15B7.7030905@redhat.com>
Date: Fri, 10 Jan 2014 07:33:43 +1000
From: David Jorm <djorm@...hat.com>
To: oss-security@...ts.openwall.com
Subject: CVE request: remote code execution via deserialization in XStream

Hi All

As per the following email thread on the xstream-dev list:

http://markmail.org/message/kfqoqdfj5fnup5co?q=list:org.codehaus.xstream.dev&page=3

Dinis Cruz et. al. have reported a remote code execution flaw in 
XStream's XML deserialization. A PoC exploit is available here:

http://blog.diniscruz.com/2013/12/xstream-remote-code-execution-exploit.html

An initial patch has been committed, adding a whitelist that limits 
deserialization to specified types:

https://fisheye.codehaus.org/changelog/xstream?cs=2210

Please assign a CVE ID to this issue.

Thanks
--
David Jorm / Red Hat Security Response Team

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.