Skip to content
OpenAdvisories
High ALAS2-2023-2080 1 CVE

Important: xmlrpc security update (Amazon Linux 2)

Published Jun 5, 2023 · Updated Jun 7, 2023

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-17570: An untrusted deserialization was found in the org.apache.xmlrpc.parser.XmlRpcResponseParser:addResult method of Apache XML-RPC (aka ws-xmlrpc) library. A malicious XML-RPC server could target a XML-RPC client causing it to execute arbitrary code. Apache XML-RPC is no longer maintained and this issue will not be fixed.

Fixed packages 4

ReleasePackageFixed in
Amazon Linux · 2 xmlrpc-client 1:3.1.3-9.amzn2.0.1
Amazon Linux · 2 xmlrpc-common 1:3.1.3-9.amzn2.0.1
Amazon Linux · 2 xmlrpc-javadoc 1:3.1.3-9.amzn2.0.1
Amazon Linux · 2 xmlrpc-server 1:3.1.3-9.amzn2.0.1

Vulnerabilities 1

  • Critical 9.8
    CVE-2019-17570 Public exploit EPSS 49%

    Insecure Deserialization in Apache XML-RPC

    An untrusted deserialization was found in the org.apache.xmlrpc.parser.XmlRpcResponseParser:addResult method of Apache XML-RPC (aka ws-xmlrpc) library. A malicious XML-RPC server could target a XML-RPC client causing it to execute arbitrary code. Apache XML-R…

    Apache Apache XML-RPC org.apache.xmlrpc:xmlrpc libxmlrpc3-java Ubuntu Maven

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2019-17570.html