CVE-2017-7957
Fixed in a distro release EPSS 5%
XStream through 1.4.9, when a certain denyTypes workaround is not used, mishandles attempts to create an instance of the primitive type 'void' during unmarshalling, leading to a remote application crash, as demonstrated by an xstream.fromXML("<void/>") call.
Products: redhat fuse, redhat jboss_middleware, xstream, debian_linux
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | com.thoughtworks.xstream:xstream | 1.4.10 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | hadoop-fips-3.3.6 | no fix |
| Chainguard | hadoop-fips-3.4.2 | no fix |
| Debian 12 | libxstream-java | 1.4.9-2 |
| Debian 13 | libxstream-java | 1.4.9-2 |
| Debian 14 | libxstream-java | 1.4.9-2 |
| Debian 7 | libxstream-java | 1.4.2-1+deb7u2 |
| Debian 8 | libxstream-java | 1.4.7-2+deb8u2 |
| SUSE Manager Proxy 3.2 | spacewalk-backend | 2.8.57.14-3.25.3 |
| SUSE Manager Proxy 3.2 | spacewalk-certs-tools | 2.8.8.7-3.6.3 |
| SUSE Manager Proxy 3.2 | spacewalk-web | 2.8.7.15-3.24.3 |
| SUSE Manager Server 3.0 | xstream | 1.4.9-4.3.1 |
| SUSE Manager Server 3.1 | xstream | 1.4.9-3.3.1 |
| SUSE Manager Server 3.2 | apache-commons-lang3 | 3.4-3.3.3 |
| SUSE Manager Server 3.2 | cobbler | 2.6.6-6.16.3 |
| SUSE Manager Server 3.2 | drools | 7.17.0-3.3.3 |
| SUSE Manager Server 3.2 | guava | 27.0.1-3.3.3 |
| SUSE Manager Server 3.2 | jade4j | 1.0.7-3.3.3 |
| SUSE Manager Server 3.2 | kie-api | 7.17.0-3.3.3 |
| SUSE Manager Server 3.2 | kie-soup | 7.17.0.Final-2.3.3 |
| SUSE Manager Server 3.2 | optaplanner | 7.17.0-3.3.3 |
| SUSE Manager Server 3.2 | py26-compat-salt | 2016.11.10-6.21.3 |
| SUSE Manager Server 3.2 | reprepro | 5.3.0-2.3.3 |
| SUSE Manager Server 3.2 | smdba | 1.6.4-0.3.9.3 |
| SUSE Manager Server 3.2 | spacecmd | 2.8.25.10-3.20.3 |
| SUSE Manager Server 3.2 | spacewalk-admin | 2.8.4.4-3.6.3 |
| SUSE Manager Server 3.2 | spacewalk-backend | 2.8.57.14-3.25.3 |
| SUSE Manager Server 3.2 | spacewalk-branding | 2.8.5.15-3.19.3 |
| SUSE Manager Server 3.2 | spacewalk-certs-tools | 2.8.8.7-3.6.3 |
| SUSE Manager Server 3.2 | spacewalk-java | 2.8.78.21-3.29.1 |
| SUSE Manager Server 3.2 | spacewalk-web | 2.8.7.15-3.24.3 |
| SUSE Manager Server 3.2 | subscription-matcher | 0.23-4.12.3 |
| SUSE Manager Server 3.2 | susemanager | 3.2.17-3.22.4 |
| SUSE Manager Server 3.2 | susemanager-schema | 3.2.18-3.22.3 |
| SUSE Manager Server 3.2 | susemanager-sls | 3.2.23-3.26.3 |
| SUSE Manager Server 3.2 | susemanager-sync-data | 3.2.14-3.20.3 |
| SUSE Manager Server 3.2 | xstream | 1.4.10-4.3.3 |
| Ubuntu 14.04 LTS | libxstream-java | 1.4.7-1ubuntu0.1 |
| Ubuntu 16.04 LTS | libxstream-java | 1.4.8-1ubuntu0.1 |
| openSUSE Tumbleweed | xstream | 1.4.18-1.1 |