remote code execution due to insecure XML deserialization when relying on blocklists
CVE: CVE-2020-26217
Component: XStream
CWE: CWE-502
Severity: Important
CVSS v3: 8.9/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Release date: 2020-11-16T19:40:00+00:00

A flaw was found in xstream. An unsafe deserialization of user-supplied XML, in conjunction with relying on the default deny list, allows a remote attacker to perform a variety of attacks including a remote code execution of arbitrary code in the context of the JVM running the XStream application. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Statement: OpenShift Container Platform (OCP) delivers jenkins package with bundled XStream library. Due to JEP-200 Jenkins project [1] and advisory SECURITY-383 [2], OCP jenkins package is not affected by this flaw.

[1] https://github.com/jenkinsci/jep/blob/master/jep/200/README.adoc
[2] https://www.jenkins.io/security/advisory/2017-02-01/  (see SECURITY-383 / CVE-2017-2608)

Remediation:
For on-premise installations, before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.

It is recommended to halt the server by stopping the JBoss Application Server process before installing this update; after installing the update, restart the server by starting the JBoss Application Server process.

The References section of this erratum contains a download link (you must log in to download the update).
For on-premise installations, before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.

It is recommended to halt the server by stopping the JBoss Application Server process before installing this update; after installing the update, restart the server by starting the JBoss Application Server process.

The References section of this erratum contains a download link (you must log in to download the update).
Refer to the Data Grid 8.1 Upgrade Guide for instructions on upgrading to this version.

The References section of this erratum contains a download link (you must log in to download the update).
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.

Installation instructions are available from the Fuse 7.10.0 product
documentation page:
https://access.redhat.com/documentation/en-us/red_hat_fuse/7.10/
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.

Installation instructions are located in the download section of the customer portal.

The References section of this erratum contains a download link (you must log in to download the update).
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Depending on the version of XStream used there are various usage patterns that mitigate this flaw, though we would strongly recommend using the allow list approach if at all possible as there are likely more class combinations the deny list approach may not address.

Allow list approach
```java
XStream xstream = new XStream();
XStream.setupDefaultSecurity(xstream);
xstream.allowTypesByWildcard(new String[] {"com.misc.classname"})
```

Deny list for XStream 1.4.13
```java
xstream.denyTypes(new String[]{ "javax.imageio.ImageIO$ContainsFilter" });
xstream.denyTypes(new Class[]{ java.lang.ProcessBuilder.class });
```

Deny list for XStream 1.4.7 -> 1.4.12
```java
xstream.denyTypes(new String[]{ "javax.imageio.ImageIO$ContainsFilter" });
xstream.denyTypes(new Class[]{ java.lang.ProcessBuilder.class, java.beans.EventHandler.class, java.lang.ProcessBuilder.class, java.lang.Void.class, void.class });
```

Deny list for versions prior to XStream 1.4.7
```java
xstream.registerConverter(new Converter() {
  public boolean canConvert(Class type) {
    return type != null && (type == java.beans.EventHandler.class || type == java.lang.ProcessBuilder.class || type == java.lang.Void.class || void.class || type.getName().equals("javax.imageio.ImageIO$ContainsFilter") || Proxy.isProxy(type));
  }

  public Object unmarshal(HierarchicalStreamReader reader, UnmarshallingContext context) {
    throw new ConversionException("Unsupported type due to security reasons.");
  }

  public void marshal(Object source, HierarchicalStreamWriter writer, MarshallingContext context) {
    throw new ConversionException("Unsupported type due to security reasons.");
  }
}, XStream.PRIORITY_LOW);
```