| Vulnerability Name: | CVE-2020-26258 (CCN-193525) | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Assigned: | 2020-12-13 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Published: | 2020-12-13 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Updated: | 2021-11-30 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Summary: | XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, a Server-Side Forgery Request vulnerability can be activated when unmarshalling. The vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.15. The reported vulnerability does not exist if running Java 15 or higher. No user is affected who followed the recommendation to setup XStream's Security Framework with a whitelist! Anyone relying on XStream's default blacklist can immediately switch to a whilelist for the allowed types to avoid the vulnerability. Users of XStream 1.4.14 or below who still want to use XStream default blacklist can use a workaround described in more detailed in the referenced advisories. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| CVSS v3 Severity: | 7.7 High (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) 6.7 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C)
6.5 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C)
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| CVSS v2 Severity: | 5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N)
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Vulnerability Type: | CWE-918 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Vulnerability Consequences: | Obtain Information | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| References: | Source: MITRE Type: CNA CVE-2020-26258 Source: XF Type: UNKNOWN xstream-cve202026258-ssrf(193525) Source: CCN Type: XStream GIT Repository A Server-Side Forgery Request can be activated unmarshalling with XStream Source: CONFIRM Type: Mitigation, Third Party Advisory https://github.com/x-stream/xstream/security/advisories/GHSA-4cch-wxpw-8p28 Source: MLIST Type: Mailing List, Third Party Advisory [struts-commits] 20201221 [struts] branch master updated: Upgrades XStream to version 1.4.15 to address CVE-2020-26258, CVE-2020-26259 Source: MLIST Type: Mailing List, Third Party Advisory [debian-lts-announce] 20201231 [SECURITY] [DLA 2507-1] libxstream-java security update Source: FEDORA Type: Mailing List, Third Party Advisory FEDORA-2021-fbad11014a Source: FEDORA Type: Mailing List, Third Party Advisory FEDORA-2021-5e376c0ed9 Source: FEDORA Type: Mailing List, Third Party Advisory FEDORA-2021-d894ca87dc Source: CONFIRM Type: Third Party Advisory https://security.netapp.com/advisory/ntap-20210409-0005/ Source: DEBIAN Type: Third Party Advisory DSA-4828 Source: CCN Type: IBM Security Bulletin 6415993 (Spectrum Control) Vulnerabilities in XStream, Apache HTTP, Jackson Databind, OpenSSL, and Node.js affect IBM Spectrum Control Source: CCN Type: IBM Security Bulletin 6416143 (Watson Discovery) IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in XStream Source: CCN Type: IBM Security Bulletin 6435555 (Tivoli Netcool Configuration Manager) A security vulnerability has been identified in Xstream, which is a required product for IBM Tivoli Network Configuration Manager (CVE-2020-26258, CVE-2020-26259) Source: CCN Type: IBM Security Bulletin 6451063 (InfoSphere Information Server) IBM InfoSphere Information Server is affected by multiple vulnerabilities in XStream Source: CCN Type: IBM Security Bulletin 6466599 (Spectrum Protect Plus) Vulnerabilities in MongoDB, Node.js, Docker, and XStream affect IBM Spectrum Protect Plus Source: CCN Type: IBM Security Bulletin 6525260 (Spectrum Copy Data Management) Vulnerabilities in XStream affect IBM Spectrum Copy Data Management Source: CCN Type: IBM Security Bulletin 6570915 (Data Risk Manager) IBM Data Risk Manager is affected by multiple vulnerabilities including a remote code execution in Spring Framework (CVE-2022-22965) Source: CCN Type: IBM Security Bulletin 6601097 (Rational Quality Manager) IBM Engineering Test Management is vulnerable to arbitrary data access due to XStream ( CVE-2020-26258, CVE-2020-26259 ) Source: CCN Type: IBM Security Bulletin 6841035 (Security Verify Governance) IBM Security Verify Governance is vulnerable to multiple security threats due to use of XStream Source: MISC Type: Exploit, Mitigation, Third Party Advisory https://x-stream.github.io/CVE-2020-26258.html | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Vulnerable Configuration: | Configuration 1: Configuration 2: Configuration 3: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Oval Definitions | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| BACK | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||