Description
The Apache XML-RPC (aka ws-xmlrpc) library 3.1.3, as used in Apache Archiva, allows remote attackers to execute arbitrary code via a crafted serialized Java object in an <ex:serializable> element.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | xmlrpc +4 | 1:3.1.3-9.el7_5 | RHSA-2018:2317, RHSA-2018:1780 |
| RHEL 6 | xmlrpc3 +7 | 3.0-4.17.el6_9 | RHSA-2018:1779 |
| RHEL 3 | rh-java-common-xmlrpc +4 | 1:3.1.3-8.16.el6 | RHSA-2018:1784 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | xmlrpc-client +3 | 1:3.1.3-9.amzn2 | ALAS2-2018-1041 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | xmlrpc-client +3 | 1:3.1.3-9.el7_5 | ELSA-2018-1780 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.xmlrpc:xmlrpc | <= 3.1.3 | — | GHSA-4gqp-296r-j5mq |
Advisories 6
- RHSA-2018:2317 Red Hat Security Advisory: xmlrpc security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2018:1784 Red Hat Security Advisory: rh-java-common-xmlrpc security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2018:1779 Red Hat Security Advisory: xmlrpc3 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2018:1780 Red Hat Security Advisory: xmlrpc security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- ALAS2-2018-1041 Important: xmlrpc security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Jul 24, 2018
- ELSA-2018-1780 Important: xmlrpc security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jun 1, 2018
References
- [oss-security] 20160712 Vulnerabilities in Apache Archiva mailing-list
- RHSA-2018:1779 vendor-advisory
- RHSA-2018:1784 vendor-advisory
- 91738 vdb-entry
- RHSA-2018:2317 vendor-advisory
- 1036294 vdb-entry
- RHSA-2018:1780 vendor-advisory
- https://0ang3el.blogspot.ru/2016/07/beware-of-ws-xmlrpc-library-in-your.html
- apache-archiva-cve20165003-code-exec(115043) vdb-entry
- 91736 vdb-entry
- RHSA-2018:3768 vendor-advisory
- [oss-security] 20200116 [CVE-2019-17570] xmlrpc-common untrusted deserialization mailing-list
- [oss-security] 20200124 RE: [CVE-2019-17570] xmlrpc-common untrusted deserialization mailing-list
- https://security.gentoo.org/glsa/202401-26