Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. e.g. JSON.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized,
    may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream
    when unmarshaling XML or any supported format. e.g. JSON. (CVE-2013-7285)

According to its self-reported version number, the version of JFrog Artifactory installed on the remote host is prior to 7.10.1. It is, therefore, affected by multiple vulnerabilities:

  - Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may     allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when     unmarshaling XML or any supported format. e.g. JSON. (CVE-2013-7285)

  - Multiple XML external entity (XXE) vulnerabilities in the Dom4JDriver, DomDriver, JDomDriver, JDom2Driver, SjsxpDriver,     StandardStaxDriver, and WstxDriver drivers in XStream before 1.4.9 allow remote attackers to read arbitrary files     via a crafted XML document. (CVE-2016-3674)

  - XStream through 1.4.9, when a certain denyTypes workaround is not used, mishandles attempts to create an instance     of the primitive type 'void' during unmarshalling, leading to a remote application crash, as demonstrated by     an xstream.fromXML call. (CVE-2017-7957)

  - The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite     loop when faced with specially crafted inputs. This can lead to a denial of service attack if an attacker can choose     the file names inside of an archive created by Compress. (CVE-2019-12402)

  - The OpenID client application in Atlassian Crowd before version 3.6.2, and from version 3.7.0 before 3.7.1     allows remote attackers to perform a Denial of Service attack via an XML Entity Expansion vulnerability. (CVE-2019-20104)

  - Go before 1.13.13 and 1.14.x before 1.14.5 has a data race in some net/http servers, as demonstrated by the     httputil.ReverseProxy Handler, because it reads a request body and writes a response at the same time. (CVE-2020-15586)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201612-35 (XStream: Remote execution of arbitrary code)

    It was found that XStream would deserialize arbitrary user-supplied XML       content, thus representing objects of any type.
  Impact :

    A remote attacker could pass a specially crafted XML document to       XStream, possibly resulting in the execution of arbitrary code with the       privileges of the process or a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

An updated jasperreports-server-pro package that fixes one security issue is now available.

The Red Hat Security Response Team has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The Red Hat Enterprise Virtualization reports package provides a suite of pre-configured reports and dashboards that enable you to monitor the system. The reports module is based on JasperReports and JasperServer, and can also be used to create ad-hoc reports.

XStream is a simple library used by the Red Hat Enterprise Virtualization reports package to serialize and de-serialize objects to and from XML.

It was found that XStream could deserialize arbitrary user-supplied XML content, representing objects of any type. A remote attacker able to pass XML to XStream could use this flaw to perform a variety of attacks, including remote code execution in the context of the server running the XStream application. (CVE-2013-7285)

All jasperreports-server-pro users are advised to upgrade to this updated package, which contains a backported patch to correct this issue.

A version of Artifactory prior to 3.1.1.1 is hosted on the remote web server.  As such, it uses a library that has a known remote code execution vulnerability.

The remote web server hosts a version of Jenkins or Jenkins Enterprise that is affected by multiple vulnerabilities :

  - A flaw in the default markup formatter allows cross-site     scripting via the Description field in the user     configuration. (CVE-2013-5573)

  - A security bypass vulnerability allows remote     authenticated attackers to change configurations and     execute arbitrary jobs. (CVE-2013-7285, CVE-2013-7330,     CVE-2014-2058)

  - An unspecified flaw in the Winstone servlet allows     remote attackers to hijack sessions. (CVE-2014-2060)

  - An input control flaw in 'PasswordParameterDefinition'     allows remote attackers to disclose sensitive     information including passwords. (CVE-2014-2061)

  - A security bypass vulnerability due to API tokens not     being invalidated when a user is deleted.
    (CVE-2014-2062)

  - An unspecified flaw allows remote attackers to conduct     clickjacking attacks. (CVE-2014-2063)

  - An information disclosure vulnerability in the     'loadUserByUsername' function allows remote attackers     to determine whether a user exists via vectors related     to failed login attempts. (CVE-2014-2064)

  - A cross-site scripting vulnerability due to improper     input validation to the 'iconSize' cookie.
    (CVE-2014-2065)

  - A session fixation vulnerability allows remote attackers     to hijack web sessions. (CVE-2014-2066)

  - An information disclosure vulnerability in the 'doIndex'     function in 'hudson/util/RemotingDiagnostics.java'     allows remote authenticated users with the     'ADMINISTRATOR' permission to obtain sensitive     information via heapDump. (CVE-2014-2068)

This update fixes remote code execution security vulnerability by applying backported upstream patch.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Jenkins Security Advisory reports :

This advisory announces multiple security vulnerabilities that were found in Jenkins core.

Please reference CVE/URL list for details

ID	Name	Product	Family	Type	Severity
423435	SCA: security update for com.thoughtworks.xstream:xstream (GHSA-f554-x222-wgf7)	Tenable Cloud Security	SCA Checks	Local	critical
423435	SCA: security update for com.thoughtworks.xstream:xstream (GHSA-f554-x222-wgf7)	Tenable Self-Hosted Container Security	SCA Checks	Local	critical
144307	JFrog < 7.10.1 Multiple Vulnerabilities	Nessus	Misc.	Local	critical
95738	GLSA-201612-35 : XStream: Remote execution of arbitrary code	Nessus	Gentoo Local Security Checks	Local	critical
79007	RHEL 6 : jasperreports-server-pro (RHSA-2014:0389)	Nessus	Red Hat Local Security Checks	Local	critical
72966	Artifactory < 3.1.1.1 XStream Remote Code Execution	Nessus	CGI abuses	Remote	critical
72685	Jenkins < 1.551 / 1.532.2 and Jenkins Enterprise 1.509.x / 1.532.x < 1.509.5.1 / 1.532.2.2 Multiple Vulnerabilities	Nessus	CGI abuses	Combined	high
72630	Fedora 20 : xstream-1.3.1-9.fc20 (2014-2372)	Nessus	Fedora Local Security Checks	Local	critical
72629	Fedora 19 : xstream-1.3.1-5.1.fc19 (2014-2340)	Nessus	Fedora Local Security Checks	Local	critical
72528	FreeBSD : jenkins -- multiple vulnerabilities (3e0507c6-9614-11e3-b3a5-00e0814cab4e)	Nessus	FreeBSD Local Security Checks	Local	critical

Detections

Analytics

CVE-2013-7285

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

high

critical

critical

critical