CVE-2019-10173 Deserialization of Untrusted Data and Code Injection in xstream
Remote attackers can execute arbitrary shell commands via deserialization if the security framework is not initialized in XStream.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-10173?
CVE-2019-10173 is a high-severity unsafe deserialization vulnerability in Oracle Banking Platform, published on 23 Jul 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw. If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when unmarshalling XML or any supported format. e.g. JSON. (regression of CVE-2013-7285)
Which versions are affected by CVE-2019-10173?
2 open source packages ship an affected version, including com.thoughtworks.xstream:xstream. It affects 10 products.
| Package | Affected | Fixed in |
|---|---|---|
com.thoughtworks.xstream:xstream Maven | From 1.4.10 | 1.4.11 |
com.thoughtworks.xstream:xstream Maven | From 1.4.10 | 1.4.11 |
Products include Oracle Banking Platform, Oracle Business Activity Monitoring, Oracle Communications Billing and Revenue Management Elastic Charging Engine, Oracle Communications Diameter Signaling Router, Oracle Communications Unified Inventory Management, Oracle Endeca Information Discovery Studio and 4 more.
How do I fix CVE-2019-10173?
Upgrade com.thoughtworks.xstream:xstream to 1.4.11 or later.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2019-10173 being exploited?
There is no known exploitation of CVE-2019-10173 in the wild and no public exploit code.
Other vulnerabilities in Oracle Banking Platform
Sources
Also known as DEBIAN-CVE-2019-10173, GHSA-hf23-9pf7-388p.