Skip to content
OpenAdvisories
High ALAS2-2018-1041 1 CVE

Important: xmlrpc security update (Amazon Linux 2)

Published Jun 20, 2018 · Updated Jul 24, 2018

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2016-5003: A flaw was discovered in the Apache XML-RPC (ws-xmlrpc) library that deserializes untrusted data when enabledForExtensions setting is enabled. A remote attacker could use this vulnerability to execute arbitrary code via a crafted serialized Java object in a <ex:serializable> element. 1508123: CVE-2016-5003 xmlrpc: Deserialization of untrusted Java object through tag

Fixed packages 4

ReleasePackageFixed in
Amazon Linux · 2 xmlrpc-client 1:3.1.3-9.amzn2
Amazon Linux · 2 xmlrpc-common 1:3.1.3-9.amzn2
Amazon Linux · 2 xmlrpc-javadoc 1:3.1.3-9.amzn2
Amazon Linux · 2 xmlrpc-server 1:3.1.3-9.amzn2

Vulnerabilities 1

  • Critical 9.8
    CVE-2016-5003 EPSS 15%

    Apache XML-RPC vulnerable to Deserialization of Untrusted Data

    The Apache XML-RPC (aka ws-xmlrpc) library 3.1.3, as used in Apache Archiva, allows remote attackers to execute arbitrary code via a crafted serialized Java object in an <ex:serializable> element.

    org.apache.xmlrpc:xmlrpc Maven

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2016-5003.html