Description
It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw. If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when unmarshalling XML or any supported format. e.g. JSON. (regression of CVE-2013-7285)
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| xstream | xstream | fixed in 1.4.11 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libxstream-java | 1.4.11-1 | — |
| Debian 13 | libxstream-java | 1.4.11-1 | — |
| Debian 12 | libxstream-java | 1.4.11-1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | com.thoughtworks.xstream:xstream | >= 1.4.10, < 1.4.11 | 1.4.11 | GHSA-hf23-9pf7-388p |
Advisories 2
- WID-SEC-2026-0180 Dell Data Protection Advisor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 20, 2026
- WID-SEC-2024-1689 Dell Data Protection Advisor: Mehrere Schwachstellen ermöglichen Codeausführung BSI CERT-Bund (WID) · Jul 22, 2024
References
- RHSA-2019:3892 vendor-advisory
- RHSA-2019:4352 vendor-advisory
- RHSA-2020:0445 vendor-advisory
- RHSA-2020:0727 vendor-advisory
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10173
- http://x-stream.github.io/changes.html#1.4.11
- https://www.oracle.com/security-alerts/cpujan2021.html
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://www.oracle.com//security-alerts/cpujul2021.html