CVE-2020-26258

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, a Server-Side Forgery Request vulnerability can be activated when unmarshalling. The vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.15. The reported vulnerability does not exist if running Java 15 or higher. No user is affected who followed the recommendation to setup XStream's Security Framework with a whitelist! Anyone relying on XStream's default blacklist can immediately switch to a whilelist for the allowed types to avoid the vulnerability. Users of XStream 1.4.14 or below who still want to use XStream default blacklist can use a workaround described in more detailed in the referenced advisories.

References

Affected packages

Git / github.com/apache/struts

Affected ranges

Type

GIT

Repo

https://github.com/apache/struts

Events

Introduced

Fixed

68fb49c10e083dce829476778eec726fc90c8c38

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "6.0.0"
        }
    ]
}

Type

GIT

Repo

https://github.com/x-stream/xstream

Events

Introduced

Fixed

f04bbec461f2c2a6f1e2cf41770f42c64aae24a4

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.4.15"
        }
    ]
}

Affected versions

Other

STRUTS_2_0_0

STRUTS_2_0_1

STRUTS_2_0_10

STRUTS_2_0_11

STRUTS_2_0_11_1

STRUTS_2_0_11_2

STRUTS_2_0_12

STRUTS_2_0_13

STRUTS_2_0_14

STRUTS_2_0_2

STRUTS_2_0_3

STRUTS_2_0_4

STRUTS_2_0_5

STRUTS_2_0_6

STRUTS_2_0_7

STRUTS_2_0_8

STRUTS_2_0_9

STRUTS_2_0_X

STRUTS_2_1_0

STRUTS_2_1_1

STRUTS_2_1_2

STRUTS_2_1_3

STRUTS_2_1_4

STRUTS_2_1_5

STRUTS_2_1_6

STRUTS_2_1_7

STRUTS_2_1_8

STRUTS_2_1_8_1

STRUTS_2_2_0

STRUTS_2_2_1

STRUTS_2_2_1_1

STRUTS_2_2_2

STRUTS_2_2_3

STRUTS_2_2_3_1

STRUTS_2_3_1

STRUTS_2_3_10

STRUTS_2_3_11

STRUTS_2_3_12

STRUTS_2_3_13

STRUTS_2_3_14

STRUTS_2_3_14_1

STRUTS_2_3_14_2

STRUTS_2_3_14_3

STRUTS_2_3_15

STRUTS_2_3_15_1

STRUTS_2_3_15_2

STRUTS_2_3_15_3

STRUTS_2_3_16

STRUTS_2_3_16_1

STRUTS_2_3_16_2

STRUTS_2_3_16_3

STRUTS_2_3_17

STRUTS_2_3_19

STRUTS_2_3_1_1

STRUTS_2_3_1_2

STRUTS_2_3_2

STRUTS_2_3_20

STRUTS_2_3_20_1

STRUTS_2_3_20_2

STRUTS_2_3_20_3

STRUTS_2_3_21

STRUTS_2_3_22

STRUTS_2_3_23

STRUTS_2_3_24

STRUTS_2_3_24_1

STRUTS_2_3_24_2

STRUTS_2_3_24_3

STRUTS_2_3_25

STRUTS_2_3_26

STRUTS_2_3_27

STRUTS_2_3_28

STRUTS_2_3_28_1

STRUTS_2_3_29

STRUTS_2_3_3

STRUTS_2_3_30

STRUTS_2_3_31

STRUTS_2_3_32

STRUTS_2_3_33

STRUTS_2_3_34

STRUTS_2_3_35

STRUTS_2_3_36

STRUTS_2_3_37

STRUTS_2_3_4

STRUTS_2_3_4_1

STRUTS_2_3_5

STRUTS_2_3_6

STRUTS_2_3_7

STRUTS_2_3_8

STRUTS_2_3_9

STRUTS_2_5

STRUTS_2_5_1

STRUTS_2_5_10

STRUTS_2_5_10_1

STRUTS_2_5_11

STRUTS_2_5_12

STRUTS_2_5_13

STRUTS_2_5_14

STRUTS_2_5_14_1

STRUTS_2_5_15

STRUTS_2_5_16

STRUTS_2_5_17

STRUTS_2_5_18

STRUTS_2_5_19

STRUTS_2_5_2

STRUTS_2_5_20

STRUTS_2_5_21

STRUTS_2_5_22

STRUTS_2_5_23

STRUTS_2_5_24

STRUTS_2_5_25

STRUTS_2_5_26

STRUTS_2_5_27

STRUTS_2_5_28

STRUTS_2_5_28_1

STRUTS_2_5_28_2

STRUTS_2_5_28_3

STRUTS_2_5_29

STRUTS_2_5_3

STRUTS_2_5_30

STRUTS_2_5_31

STRUTS_2_5_32

STRUTS_2_5_33

STRUTS_2_5_4

STRUTS_2_5_5

STRUTS_2_5_6

STRUTS_2_5_7

STRUTS_2_5_8

STRUTS_2_5_9

STRUTS_2_5_BETA1

STRUTS_2_5_BETA2

STRUTS_2_5_BETA3

STRUTS_6_0_0_RC1

STRUTS_6_0_0_RC2

STRUTS_6_0_0_RC3

STRUTS_6_0_0_RC4

XSTREAM_0_2

XSTREAM_0_3

XSTREAM_0_4

XSTREAM_0_5

XSTREAM_0_6

XSTREAM_0_6_RC1

XSTREAM_1_0_1

XSTREAM_1_0_2

XSTREAM_1_0_RC1

XSTREAM_1_1

XSTREAM_1_1_1

XSTREAM_1_1_2

XSTREAM_1_1_3

XSTREAM_1_2

XSTREAM_1_2_1

XSTREAM_1_2_2

XSTREAM_1_3

XSTREAM_1_3_1

XSTREAM_1_4

XSTREAM_1_4_1

XSTREAM_1_4_10

XSTREAM_1_4_11

XSTREAM_1_4_11_1

XSTREAM_1_4_12

XSTREAM_1_4_13

XSTREAM_1_4_14

XSTREAM_1_4_2

XSTREAM_1_4_3

XSTREAM_1_4_4

XSTREAM_1_4_5

XSTREAM_1_4_6

XSTREAM_1_4_7

XSTREAM_1_4_8

XSTREAM_1_4_9

struts2-parent-2.*

struts2-parent-2.0.10

struts2-parent-2.3.1.2

struts2-parent-2.3.14.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-26258.json"

unresolved_ranges

[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "9.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "10.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "33"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "34"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "35"
            }
        ]
    }
]