Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 501
Alerts This Week
Warning Icon 1 501

SUSE: 2021:0176-1 Important: Xstream Remote Code Execution Fix

suse
Calendar Grey January 20, 2021
Dist Suse Esm H88
SUSE announced a crucial security update that resolves multiple severe vulnerabilities in xstream, including risks like unauthorized remote code execution and sensitive file deletion
An update that fixes three vulnerabilities is now available

Summary

This update for xstream fixes the following issues: xstream was updated to version 1.4.15. - CVE-2020-26217: Fixed a remote code execution due to insecure XML deserialization when relying on blocklists (bsc#1180994). - CVE-2020-26258: Fixed a server-side request forgery vulnerability (bsc#1180146). - CVE-2020-26259: Fixed an arbitrary file deletion vulnerability (bsc#1180145). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Module for Development Tools 15-SP2: zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP2-2021-176=1 Package List: - SUSE Linux Enterprise Module for Development Tools 15-SP2 (noarch):

Topics%20covered

Topics Covered

security advisory remote code execution important SUSE file deletion server-side request

References

#1180145 #1180146 #1180994

Cross- CVE-2020-26217 CVE-2020-26258 CVE-2020-26259

Affected Products:

SUSE Linux Enterprise Module for Development Tools 15-SP2

https://www.suse.com/security/cve/CVE-2020-26217.html

https://www.suse.com/security/cve/CVE-2020-26258.html

https://www.suse.com/security/cve/CVE-2020-26259.html

https://bugzilla.suse.com/1180145

https://bugzilla.suse.com/1180146

https://bugzilla.suse.com/1180994

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: SUSE-SU-2021:0176-1
Rating: important

Topics%20covered

Topics Covered

security advisory remote code execution important SUSE file deletion server-side request

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.