Alerts This Week
Warning Icon 1 758
Alerts This Week
Warning Icon 1 758

Debian: DSA-4619-1 Moderate: libxmlrpc3-java Remote Code Execution

debian
Calendar Grey February 6, 2020
Debian Logo
Improve libxmlrpc3-java functionality to rectify deserialization vulnerabilities that may expose systems to remote code execution threats.
Guillaume Teissier reported that the XMLRPC client in libxmlrpc3-java, an XML-RPC implementation in Java, does perform deserialization of the server-side exception serialized in th...
Topics%20covered

Topics Covered

security advisory remote code execution debian deserialization issue libxmlrpc3-java

Summary

Note that a client that expects to get server-side exceptions need to
set explicitly the enabledForExceptions property.

For the oldstable distribution (stretch), this problem has been fixed
in version 3.1.3-8+deb9u1.

For the stable distribution (buster), this problem has been fixed in
version 3.1.3-9+deb10u1.

We recommend that you upgrade your libxmlrpc3-java packages.

For the detailed security status of libxmlrpc3-java please refer to
its security tracker page at:


Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/



Severity
important
Lowest
Low
Medium
High
Critical

Package: libxmlrpc3-java
CVE ID: CVE-2019-17570

Topics%20covered

Topics Covered

security advisory remote code execution debian deserialization issue libxmlrpc3-java

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here