https://bugzilla.redhat.com/show_bug.cgi?id=1908832
Bug ID: 1908832 Summary: CVE-2020-26258 XStream: Server-Side Forgery Request vulnerability can be activated when unmarshalling Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team@redhat.com Reporter: gsuckevi@redhat.com CC: abenaiss@redhat.com, aileenc@redhat.com, akoufoud@redhat.com, alazarot@redhat.com, almorale@redhat.com, anstephe@redhat.com, aos-bugs@redhat.com, ataylor@redhat.com, bibryam@redhat.com, bmontgom@redhat.com, chazlett@redhat.com, dchen@redhat.com, drieden@redhat.com, eparis@redhat.com, etirelli@redhat.com, ganandan@redhat.com, ggaughan@redhat.com, gmalinko@redhat.com, gvarsami@redhat.com, hbraun@redhat.com, ibek@redhat.com, janstey@redhat.com, java-maint@redhat.com, java-sig-commits@lists.fedoraproject.org, jburrell@redhat.com, jcoleman@redhat.com, jochrist@redhat.com, jokerman@redhat.com, jolee@redhat.com, jschatte@redhat.com, jstastny@redhat.com, jwon@redhat.com, kaycoth@redhat.com, kconner@redhat.com, krathod@redhat.com, kverlaen@redhat.com, ldimaggi@redhat.com, lkundrak@v3.sk, mizdebsk@redhat.com, mnovotny@redhat.com, nstielau@redhat.com, nwallace@redhat.com, pantinor@redhat.com, pbhattac@redhat.com, pjindal@redhat.com, rrajasek@redhat.com, rsynek@redhat.com, rwagner@redhat.com, sdaley@redhat.com, sponnaga@redhat.com, tcunning@redhat.com, tkirby@redhat.com, vbobade@redhat.com, vhalbert@redhat.com Target Milestone: --- Classification: Other
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, a Server-Side Forgery Request vulnerability can be activated when unmarshalling. The vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.15. The reported vulnerability does not exist if running Java 15 or higher. No user is affected who followed the recommendation to setup XStream's Security Framework with a whitelist! Anyone relying on XStream's default blacklist can immediately switch to a whilelist for the allowed types to avoid the vulnerability. Users of XStream 1.4.14 or below who still want to use XStream default blacklist can use a workaround described in more detailed in the referenced advisories.
References: https://github.com/x-stream/xstream/security/advisories/GHSA-4cch-wxpw-8p28 https://x-stream.github.io/CVE-2020-26258.html
https://bugzilla.redhat.com/show_bug.cgi?id=1908832
Guilherme de Almeida Suckevicz gsuckevi@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1908833
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1908833 [Bug 1908833] CVE-2020-26258 xstream: Server-Side Forgery Request vulnerability can be activated when unmarshalling [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1908832
--- Comment #1 from Guilherme de Almeida Suckevicz gsuckevi@redhat.com --- Created xstream tracking bugs for this issue:
Affects: fedora-all [bug 1908833]
https://bugzilla.redhat.com/show_bug.cgi?id=1908832
Guilherme de Almeida Suckevicz gsuckevi@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1908834
--- Comment #1 from Guilherme de Almeida Suckevicz gsuckevi@redhat.com --- Created xstream tracking bugs for this issue:
Affects: fedora-all [bug 1908833]
--- Comment #2 from Guilherme de Almeida Suckevicz gsuckevi@redhat.com --- Created xstream tracking bugs for this issue:
Affects: fedora-all [bug 1908833]
https://bugzilla.redhat.com/show_bug.cgi?id=1908832
--- Comment #4 from Paramvir jindal pjindal@redhat.com --- Mitigation:
As recommended, use XStream's security framework to implement a whitelist for the allowed types.
Users of XStream 1.4.14 who insist to use XStream default blacklist - despite that clear recommendation - can simply add two lines to XStream's setup code:
xstream.denyTypes(new String[]{ "jdk.nashorn.internal.objects.NativeString" }); xstream.denyTypesByRegExp(new String[]{ ".*\.ReadAllStream\$FileStream" });
Users of XStream 1.4.13 who want to use XStream default blacklist can simply add three lines to XStream's setup code:
xstream.denyTypes(new String[]{ "javax.imageio.ImageIO$ContainsFilter", "jdk.nashorn.internal.objects.NativeString" }); xstream.denyTypes(new Class[]{ java.lang.ProcessBuilder.class }); xstream.denyTypesByRegExp(new String[]{ ".*\.ReadAllStream\$FileStream" });
Users of XStream 1.4.12 to 1.4.7 who want to use XStream with a blacklist will have to setup such a list from scratch and deny at least the following types: javax.imageio.ImageIO$ContainsFilter, java.beans.EventHandler, java.lang.ProcessBuilder, jdk.nashorn.internal.objects.NativeString, java.lang.Void and void and deny several types by name pattern.
xstream.denyTypes(new String[]{ "javax.imageio.ImageIO$ContainsFilter", "jdk.nashorn.internal.objects.NativeString" }); xstream.denyTypes(new Class[]{ java.lang.ProcessBuilder.class, java.beans.EventHandler.class, java.lang.ProcessBuilder.class, java.lang.Void.class, void.class }); xstream.denyTypesByRegExp(new String[]{ ".*\$LazyIterator", "javax\.crypto\..*", ".*\.ReadAllStream\$FileStream" });
Users of XStream 1.4.6 or below can register an own converter to prevent the unmarshalling of the currently know critical types of the Java runtime. It is in fact an updated version of the workaround for CVE-2013-7285:
xstream.registerConverter(new Converter() { public boolean canConvert(Class type) { return type != null && (type == java.beans.EventHandler.class || type == java.lang.ProcessBuilder.class || type.getName().equals("javax.imageio.ImageIO$ContainsFilter") || type.getName().equals("jdk.nashorn.internal.objects.NativeString") || type == java.lang.Void.class || void.class || Proxy.isProxy(type) || type.getName().startsWith("javax.crypto.") || type.getName().endsWith("$LazyIterator") || type.getName().endsWith(".ReadAllStream$FileStream")); }
public Object unmarshal(HierarchicalStreamReader reader, UnmarshallingContext context) { throw new ConversionException("Unsupported type due to security reasons."); }
public void marshal(Object source, HierarchicalStreamWriter writer, MarshallingContext context) { throw new ConversionException("Unsupported type due to security reasons."); } }, XStream.PRIORITY_LOW);
https://bugzilla.redhat.com/show_bug.cgi?id=1908832
--- Comment #5 from Paramvir jindal pjindal@redhat.com --- This vulnerability is out of security support scope for the following products:
* Red Hat Data Grid 7 * Red Hat JBoss BRMS 6 * Red Hat JBoss BPMS 6 * Red Hat JBoss Data Virtualization 6 * Red Hat JBoss Fuse 6 * Red Hat JBoss Fuse Service Works 6 * Red Hat JBoss SOA Platform 5
Please refer to https://access.redhat.com/support/policy/updates/jboss_notes for more details.
https://bugzilla.redhat.com/show_bug.cgi?id=1908832
Paramvir jindal pjindal@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://issues.redhat.com/b | |rowse/ENTESB-15478, | |https://issues.redhat.com/b | |rowse/JDG-4264, | |https://issues.redhat.com/b | |rowse/RHDM-1547, | |https://issues.redhat.com/b | |rowse/RHPAM-3368, | |https://issues.redhat.com/b | |rowse/ENTESB-15479
https://bugzilla.redhat.com/show_bug.cgi?id=1908832
Przemyslaw Roguski proguski@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Fixed In Version| |xstream-1.4.15
--- Comment #7 from Przemyslaw Roguski proguski@redhat.com --- Upstream commit: https://github.com/x-stream/xstream/commit/6740c04b217aef02d44fba26402b35e0f...
https://bugzilla.redhat.com/show_bug.cgi?id=1908832
--- Comment #12 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat Data Grid 8.2.0
Via RHSA-2021:2139 https://access.redhat.com/errata/RHSA-2021:2139
https://bugzilla.redhat.com/show_bug.cgi?id=1908832
Product Security DevOps Team prodsec-dev@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Resolution|--- |ERRATA Last Closed| |2021-05-26 23:32:08
--- Comment #13 from Product Security DevOps Team prodsec-dev@redhat.com --- This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):
https://access.redhat.com/security/cve/cve-2020-26258
https://bugzilla.redhat.com/show_bug.cgi?id=1908832
--- Comment #14 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
RHPAM 7.11.0
Via RHSA-2021:2475 https://access.redhat.com/errata/RHSA-2021:2475
https://bugzilla.redhat.com/show_bug.cgi?id=1908832
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2021:2475
https://bugzilla.redhat.com/show_bug.cgi?id=1908832
--- Comment #15 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
RHDM 7.11.0
Via RHSA-2021:2476 https://access.redhat.com/errata/RHSA-2021:2476
https://bugzilla.redhat.com/show_bug.cgi?id=1908832
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2021:2476
https://bugzilla.redhat.com/show_bug.cgi?id=1908832
--- Comment #17 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat Fuse 7.9
Via RHSA-2021:3140 https://access.redhat.com/errata/RHSA-2021:3140
https://bugzilla.redhat.com/show_bug.cgi?id=1908832
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2021:3140
https://bugzilla.redhat.com/show_bug.cgi?id=1908832 Bug 1908832 depends on bug 1908833, which changed state.
Bug 1908833 Summary: CVE-2020-26258 xstream: Server-Side Forgery Request vulnerability can be activated when unmarshalling [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1908833
What |Removed |Added ---------------------------------------------------------------------------- Status|ON_QA |CLOSED Resolution|--- |ERRATA
https://bugzilla.redhat.com/show_bug.cgi?id=1908832
--- Comment #18 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat Integration
Via RHSA-2021:4767 https://access.redhat.com/errata/RHSA-2021:4767
https://bugzilla.redhat.com/show_bug.cgi?id=1908832
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2021:4767
java-sig-commits@lists.fedoraproject.org