huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2020-1971: openssl: EDIPARTYNAME NULL pointer de-reference
Component: openssl
Severity: Important
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2020-12-08T00:00:00+00:00

A null pointer dereference flaw was found in openssl. A remote attacker, able to control the arguments of the GENERAL_NAME_cmp function, could cause the application, compiled with openssl to crash resulting in a denial of service. The highest threat from this vulnerability is to system availability.

Statement: This is a flaw in the GENERAL_NAME_cmp function of openssl which can be triggered when both its arguments are of the same type i.e. EDIPARTYNAME. 

1. Red Hat does not ship any applications compiled with openssl, which used the above function in a vulnerable way.

2. OpenSSL itself uses the GENERAL_NAME_cmp function for two purposes, when comparing CRL distribution point names between an available CRL and a CRL distribution point embedded in an X509 certificate and when verifying that a timestamp response token signer matches the timestamp authority name (exposed via the API functions TS_RESP_verify_response and TS_RESP_verify_token). If an attacker can control both items being compared then that attacker could trigger a crash. For example, if the attacker can trick a client or server into checking a malicious certificate against a malicious CRL then a crash may be triggered.

Third party applications compiled with openssl using the function GENERAL_NAME_cmp in a vulnerable way are affected by this flaw.

GENERAL_NAME_cmp was added in 0.9.8k, therefore older versions of openssl are not affected by this flaw.

Affected upstream versions: Fixed in OpenSSL 1.1.1i (Affected 1.1.1-1.1.1h), Fixed in OpenSSL 1.0.2x (Affected 1.0.2-1.0.2w)
Fixed upstream versions: OpenSSL_1_1_1i
Upstream repository: https://git.openssl.org/gitweb/openssl.git
Upstream fix commit: f960d81215ebf3f65e03d4d5d857fb9b666d6920
CVE-2020-1983: QEMU: slirp: use-after-free in ip_reass() function in ip_input.c
Component: QEMU
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 6.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H)
Public date: 2020-04-02T00:00:00+00:00

A use-after-free flaw was found in the SLiRP networking implementation of the QEMU emulator. Specifically, this flaw occurs in the ip_reass() routine while reassembling incoming IP fragments whose combined size is bigger than 65k. This flaw allows an attacker to crash the QEMU process on the host, resulting in a denial of service.


Affected upstream versions: unspecified <= 4.2.0
Fixed upstream versions: v4.3.0
Upstream repository: https://gitlab.freedesktop.org/slirp/libslirp
Upstream fix commit: 9ac0371bb8c0a40f5d9f82a1c25129660e81df04
CVE-2020-21710: ghostscript: Divide by zero in eps_print_page in gdevepsn.c
Component: ghostscript
Severity: Low
CWE: CWE-369 (Divide By Zero)
CVSS v3: 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Public date: 2023-08-22T00:00:00+00:00

GhostScript is vulnerable to divide by zero issue in function eps_print_page in gdevepsn.c allows remote attacker to cause a denial of service via crafted PDF file.


Affected upstream versions: n/a
Fixed upstream versions: gpdf_gs_text_filter_000
Upstream repository: https://git.ghostscript.com/ghostpdl.git
Upstream fix commit: 4e713293de84b689c4ab358f3e110ea54aa81925
CVE-2020-24370: lua: segmentation fault in getlocal and setlocal functions in ldebug.c
Component: lua
Severity: Low
CWE: CWE-682 (Incorrect Calculation)
CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2020-07-24T00:00:00+00:00

ldebug.c in Lua 5.4.0 allows a negation overflow and segmentation fault in getlocal and setlocal, as demonstrated by getlocal(3,2^31).


Affected upstream versions: n/a
Fixed upstream versions: v5.4.1
Upstream repository: https://github.com/lua/lua
Upstream fix commit: a585eae6e7ada1ca9271607a4f48dfb17868ab7b
CVE-2020-24394: kernel: umask not applied on filesystem without ACL support
Component: kernel
Severity: Moderate
CWE: CWE-732 (Incorrect Permission Assignment for Critical Resource)
CVSS v3: 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N)
Public date: 2020-06-05T00:00:00+00:00

A vulnerability was found in NFSv4.2 in the Linux kernel, where a server fails to correctly apply umask when creating a new object on filesystem without ACL support (for example, ext4 with the "noacl" mount option). This flaw allows a local attacker with a user privilege to cause a kernel information leak problem.


Affected upstream versions: n/a
Fixed upstream versions: v5.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 22cf8419f1319ff87ec759d0ebdff4cbafaee832
CVE-2020-24490: kernel: net: bluetooth: heap buffer overflow when processing extended advertising report events
Component: kernel
Severity: Moderate
CWE: CWE-122 (Heap-based Buffer Overflow)
CVSS v3: 7.1 (CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2020-10-14T00:00:00+00:00

A heap buffer overflow flaw was found in the way the Linux kernel’s Bluetooth implementation processed extended advertising report events. This flaw allows a remote attacker in an adjacent range to crash the system, causing a denial of service or to potentially execute arbitrary code on the system by sending a specially crafted Bluetooth packet. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

Statement: This issue is rated as having Moderate impact because the system needs to be actively scanning while the attacker is sending the advertisements in order to be exploited.

This issue only affects the Linux kernel version as shipped with the Red Hat Enterprise Linux 8.3 GA release, kernel-4.18.0-240.el8 (and any kernel derived from this release such as kernel rt-4.18.0-240.rt7.54.el8). Red Hat was unable to include the fixes in the GA release, as the Red Hat Enterprise Linux 8.3 GA release was in its final stages of release preparation when CVE-2020-24490 was made public. All of the subsequent Red Hat Enterprise Linux 8 kernel versions, including the version included in the so-called 0day (released on the same day or very close to that day) erratum, contain the fix, thus immune to this issue.

Affected upstream versions: all Linux kernel versions that support BlueZ
Fixed upstream versions: v5.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next.git
Upstream fix commit: a2ec905d1e160a33b2e210e45ad30445ef26ce0e
CVE-2020-24750: jackson-databind: Serialization gadgets in com.pastdev.httpcomponents.configuration.JndiConfiguration
Component: jackson-databind
Severity: Important
CWE: CWE-502 (Deserialization of Untrusted Data)
CVSS v3: 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2020-09-18T00:00:00+00:00

A flaw was found in jackson-databind 2.x in versions prior to 2.9.10.6. The interaction between serialization gadgets and typing is mishandled. The highest threat from this vulnerability is to data confidentiality and system availability.

Statement: The following Red Hat products do ship the vulnerable component, but do not enable the unsafe conditions needed to exploit:
* JBoss Data Grid 7
* Business Process Management Suite 6
* Business Rules Management Suite 6
* JBoss Data Virtualization 6
* OpenShift Container Platform
These products may update the jackson-databind dependency in a future release.

The following Red Hat products ship OpenDaylight, which contains the vulnerable jackson-databind, but do not expose jackson-databind in a way that would make it exploitable
* Red Hat OpenStack Platform 13
As such, Red Hat will not be providing a fix for OpenDaylight at this time.

The following Red Hat products are not affected by this flaw because they use a more recent version of jackson-databind that does not contain the vulnerable code:
* CodeReady Studio 12.16.0
* Red Hat Enterprise Linux 8
* Red Hat Enterprise Virtualization
* Red Hat Satellite 6

Affected upstream versions: n/a
Fixed upstream versions: jackson-databind-2.9.10.7
Upstream repository: https://github.com/FasterXML/jackson-databind
Upstream fix commit: ad5a630174f08d279504bc51ebba8772fd71b86b
CVE-2020-24870: LibRaw: Stack buffer overflow in LibRaw::identify_process_dng_fields() in identify.cpp
Component: LibRaw
Severity: Moderate
CWE: CWE-120 (Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'))
CVSS v3: 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2020-08-19T00:00:00+00:00

A stack buffer overflow vulnerability was found in LibRaw. This flaw allows a malicious user to send a crafted image that, when parsed by an application linked to LibRaw, leads to a denial of service or potential code execution.

Statement: LibRaw is not supposed to be used in RHEL by network-facing applications, thus reducing the impact of this flaw.

Affected upstream versions: n/a
Fixed upstream versions: 0.20.1
Upstream repository: https://github.com/LibRaw/LibRaw
Upstream fix commit: 4feaed4dea636cee4fee010f615881ccf76a096d
CVE-2020-24977: libxml2: Buffer overflow vulnerability in xmlEncodeEntitiesInternal() in entities.c
Component: libxml2
Severity: Moderate
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L)
Public date: 2020-09-04T00:00:00+00:00

GNOME project libxml2 v2.9.10 has a global buffer over-read vulnerability in xmlEncodeEntitiesInternal at libxml2/entities.c. The issue has been fixed in commit 50f06b3e.


Affected upstream versions: n/a
Fixed upstream versions: v2.9.11
Upstream repository: https://gitlab.gnome.org/GNOME/libxml2
Upstream fix commit: 50f06b3efb638efb0abd95dc62dca05ae67882c2
CVE-2020-25211: kernel: Local buffer overflow in ctnetlink_parse_tuple_filter in net/netfilter/nf_conntrack_netlink.c
Component: kernel
Severity: Important
CWE: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer)
CVSS v3: 6.7 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Public date: 2020-09-09T00:00:00+00:00

A flaw was found in the Linux kernel. A local attacker, able to inject conntrack netlink configuration, could overflow a local buffer causing crashes or triggering the use of incorrect protocol numbers in ctnetlink_parse_tuple_filter in net/netfilter/nf_conntrack_netlink.c. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Statement: This flaw is rated as having Moderate impact (Red Hat Enterprise Linux 7 and lower)  because of the need to have CAP_NET_ADMIN privileges.

This flaw is rated as having Important (Red Hat Enterprise Linux 8) impact because of the need to have CAP_NET_ADMIN privileges. Red Hat Enterprise Linux 8 enabled unprivileged user/network namespaces by default which can be used to exercise this vulnerability.

Affected upstream versions: n/a
Fixed upstream versions: v5.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 1cc5ef91d2ff94d2bf2de3b3585423e8a1051cb6
CVE-2020-25212: kernel: TOCTOU mismatch in the NFS client code
Component: kernel
Severity: Moderate
CWE: CWE-367 (Time-of-check Time-of-use (TOCTOU) Race Condition)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2020-09-09T00:00:00+00:00

A flaw was found in the NFSv4 implementation where when mounting a remote attacker controlled server it could return specially crafted response allow for local memory corruption and possibly privilege escalation.


Affected upstream versions: n/a
Fixed upstream versions: v5.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: b4487b93545214a9db8cbf32e86411677b0cca21
CVE-2020-25284: kernel: incomplete permission checking for access to rbd devices
Component: kernel
Severity: Moderate
CWE: CWE-732 (Incorrect Permission Assignment for Critical Resource)
CVSS v3: 4.1 (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N)
Public date: 2020-09-13T00:00:00+00:00

A flaw was found in the capabilities check of the rados block device functionality in the Linux kernel. Incorrect capability checks could alllow a local user with root priviledges (but no capabilities) to add or remove Rados Block Devices from the system.


Affected upstream versions: n/a
Fixed upstream versions: v5.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: f44d04e696feaf13d192d942c4f14ad2e117065a
CVE-2020-25285: kernel: race condition between hugetlb sysctl handlers in mm/hugetlb.c
Component: kernel
Severity: Moderate
CWE: CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'))
CVSS v3: 6.4 (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)
Public date: 2020-09-13T00:00:00+00:00

A flaw was found in the Linux kernels sysctl handling code for hugepages management. When multiple root level processes would write to modify the /proc/sys/vm/nr_hugepages file it could create a race on internal variables leading to a system crash or memory corruption.

Statement: This flaw is rated as having Moderate impact as access to write to /proc/sys/vm/nr_hugepages is restricted to root and not available to regular users.

Affected upstream versions: n/a
Fixed upstream versions: v5.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 17743798d81238ab13050e8e2833699b54e15467
CVE-2020-25613: ruby: Potential HTTP request smuggling in WEBrick
Component: ruby
Severity: Moderate
CWE: CWE-444 (Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling'))
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Public date: 2020-09-29T00:00:00+00:00

An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP server bundled with Ruby, had not checked the transfer-encoding header value rigorously. An attacker may potentially exploit this issue to bypass a reverse proxy (which also has a poor header check), which may lead to an HTTP Request Smuggling attack.


Affected upstream versions: n/a
Fixed upstream versions: v1.7.0
Upstream repository: https://github.com/ruby/webrick
Upstream fix commit: 8946bb38b4d87549f0d99ed73c62c41933f97cc7
CVE-2020-25641: kernel: soft-lockups in iov_iter_copy_from_user_atomic() could result in DoS
Component: kernel
Severity: Moderate
CWE: CWE-835 (Loop with Unreachable Exit Condition ('Infinite Loop'))
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2020-09-30T00:24:00+00:00

A flaw was found in the Linux kernel’s implementation of biovecs. A zero-length biovec request issued by the block subsystem could cause the kernel to enter an infinite loop, causing a denial of service. This flaw allows a local attacker with basic privileges to issue requests to a block device, resulting in a denial of service. The highest threat from this vulnerability is to system availability.


Affected upstream versions: kernel versions before 5.9-rc7
Fixed upstream versions: v5.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 7e24969022cbd61ddc586f14824fc205661bb124
CVE-2020-25643: kernel: improper input validation in ppp_cp_parse_cr function leads to memory corruption and read overflow
Component: kernel
Severity: Moderate
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 7.2 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Public date: 2020-09-25T00:00:00+00:00

A flaw was found in the HDLC_PPP module of the Linux kernel.  Memory corruption and a read overflow is caused by improper input validation in the ppp_cp_parse_cr function which can cause the system to crash or cause a denial of service.  The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Statement: This flaw is rated as a having Moderate impact, because the bug can be triggered only if PPP protocol enabled.

Affected upstream versions: Linux kernel versions before 5.9-rc7
Fixed upstream versions: v5.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 66d42ed8b25b64eb63111a2b8582c5afc8bf1105
CVE-2020-25659: python-cryptography: Bleichenbacher timing oracle attack against RSA decryption
Component: python-cryptography
Severity: Moderate
CWE: CWE-385 (Covert Timing Channel)
CVSS v3: 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
Public date: 2020-10-25T00:00:00+00:00

A flaw was found in python-cryptography, where it is vulnerable to Bleichenbacher timing attacks. This flaw allows an attacker, via the RSA decryption API, to decrypt parts of the ciphertext encrypted with RSA. The highest threat from this vulnerability is to confidentiality.

Statement: In Red Hat OpenStack Platform, because the flaw has a lower impact and the fix would require a substantial amount of development, no update will be provided at this time for the RHOSP python-cryptography package.

Affected upstream versions: python-cryptography 3.2
Upstream repository: https://github.com/pyca/cryptography
Upstream fix commit: ce1bef6f1ee06ac497ca0c837fbd1c7ef6c2472b
CVE-2020-25704: kernel: perf_event_parse_addr_filter memory
Component: kernel
Severity: Moderate
CWE: CWE-401 (Missing Release of Memory after Effective Lifetime)
CVSS v3: 6.2 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2020-11-09T00:00:00+00:00

A memory leak flaw was found in the Linux kernel’s performance monitoring subsystem when using PERF_EVENT_IOC_SET_FILTER. This flaw allows a local user to starve the resources, causing a denial of service. The highest threat from this vulnerability is to system availability.


Affected upstream versions: kernel 5.10-rc3
Fixed upstream versions: v5.10
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 7bdb157cdebbf95a1cd94ed2e01b338714075d00
CVE-2020-25708: libvncserver: libvncserver/rfbserver.c has a divide by zero which could result in DoS
Component: libvncserver
Severity: Moderate
CWE: CWE-369 (Divide By Zero)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2020-05-13T00:00:00+00:00

A divide by zero flaw was found in libvncserver. This flaw allows a malicious client to send a specially crafted message that, when processed by the VNC server, leads to a floating-point exception, resulting in a denial of service. The highest threat from this vulnerability is to system availability.


Affected upstream versions: libvncserver 0.9.12
Fixed upstream versions: LibVNCServer-0.9.13
Upstream repository: https://github.com/LibVNC/libvncserver
Upstream fix commit: 673c07a75ed844d74676f3ccdcfdc706a7052dba
CVE-2020-25709: openldap: assertion failure in Certificate List syntax validation
Component: openldap
Severity: Moderate
CWE: CWE-617 (Reachable Assertion)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2020-11-02T00:00:00+00:00

A flaw was found in OpenLDAP. This flaw allows an attacker who can send a malicious packet to be processed by OpenLDAP’s slapd server, to trigger an assertion failure. The highest threat from this vulnerability is to system availability.

Statement: This flaw does not affect Red Hat Enterprise Linux 8 because the slapd server is not shipped in the Red Hat Enterprise Linux 8 repositories.

Affected upstream versions: openldap 2.4.56
Fixed upstream versions: OPENLDAP_REL_ENG_2_4_56
Upstream repository: https://git.openldap.org/openldap/openldap
Upstream fix commit: ab3915154e69920d480205b4bf5ccb2b391a0a1f
CVE-2020-25710: openldap: assertion failure in CSN normalization with invalid input
Component: openldap
Severity: Moderate
CWE: CWE-617 (Reachable Assertion)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2020-11-02T00:00:00+00:00

A flaw was found in OpenLDAP. This flaw allows an attacker who sends a malicious packet processed by OpenLDAP to force a failed assertion in csnNormalize23(). The highest threat from this vulnerability is to system availability.

Statement: This flaw does not affect Red Hat Enterprise Linux 8 because the slapd server is not shipped in the Red Hat Enterprise Linux 8 repositories.

Affected upstream versions: openldap 2.4.56
Fixed upstream versions: OPENLDAP_REL_ENG_2_4_56
Upstream repository: https://git.openldap.org/openldap/openldap
Upstream fix commit: ab3915154e69920d480205b4bf5ccb2b391a0a1f
CVE-2020-26117: tigervnc: certificate exceptions stored as authorities
Component: tigervnc
Severity: Moderate
CWE: CWE-296 (Improper Following of a Certificate's Chain of Trust)
CVSS v3: 8.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N)
Public date: 2020-09-18T00:00:00+00:00

In rfb/CSecurityTLS.cxx and rfb/CSecurityTLS.java in TigerVNC before 1.11.0, viewers mishandle TLS certificate exceptions. They store the certificates as authorities, meaning that the owner of a certificate could impersonate any server after a client had added an exception.


Affected upstream versions: n/a
Fixed upstream versions: v1.11.90
Upstream repository: https://github.com/TigerVNC/tigervnc
Upstream fix commit: f029745f63ac7d22fb91639b2cb5b3ab56134d6e
CVE-2020-26137: python-urllib3: CRLF injection via HTTP request method
Component: python-urllib3
Severity: Moderate
CWE: CWE-113 (Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting'))
CVSS v3: 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
Public date: 2020-02-10T00:00:00+00:00

A flaw was found in python-urllib3. The HTTPConnection.request() does not properly validate CRLF sequences in the HTTP request method, potentially allowing manipulation of the request by injecting additional HTTP headers. The highest threat from this vulnerability is to confidentiality and integrity.

Statement: * Red Hat OpenShift Container Platform (OCP) 4 delivers the python-urllib3 package, which includes a vulnerable version of the urllib3 module, however from OCP 4.6, the python-urllib3 package is no longer shipped and will not be fixed.
* In Red Hat OpenStack Platform, because the flaw has a lower impact and the fix would require a substantial amount of development, no update will be provided at this time for the RHOSP python-urllib3 package.

Note: Versions of `python-pip` are marked as not affected because there is no way for a pip user to control the HTTP request method.

Affected upstream versions: n/a
Fixed upstream versions: 1.25.9
Upstream repository: https://github.com/urllib3/urllib3
Upstream fix commit: 1dd69c5c5982fae7c87a620d487c2ebf7a6b436b
CVE-2020-26217: XStream: remote code execution due to insecure XML deserialization when relying on blocklists
Component: XStream
Severity: Important
CWE: CWE-502 (Deserialization of Untrusted Data)
CVSS v3: 9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H)
Public date: 2020-11-16T19:40:00+00:00

A flaw was found in xstream. An unsafe deserialization of user-supplied XML, in conjunction with relying on the default deny list, allows a remote attacker to perform a variety of attacks including a remote code execution of arbitrary code in the context of the JVM running the XStream application. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Statement: OpenShift Container Platform (OCP) delivers jenkins package with bundled XStream library. Due to JEP-200 Jenkins project [1] and advisory SECURITY-383 [2], OCP jenkins package is not affected by this flaw.

[1] https://github.com/jenkinsci/jep/blob/master/jep/200/README.adoc
[2] https://www.jenkins.io/security/advisory/2017-02-01/  (see SECURITY-383 / CVE-2017-2608)

Affected upstream versions: < 1.4.14
Fixed upstream versions: XSTREAM_1_4_14
Upstream repository: https://github.com/x-stream/xstream
Upstream fix commit: 0fec095d534126931c99fd38e9c6d41f5c685c1a