CVE-2020-26217

Katalog CVE

CVSS 8.8 · High EPSS 85,0%

Kerentanan Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') pada xstream, debian linux +13 lainnya. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream. Only users who rely on blocklists are affected. Anyone using XStream's Security Framework allowlist is not affected. The linked advisory provides code workarounds for users who cannot upgrade. The issue is fixed in version 1.4.14.

Rincian

Terbit di NVD

16 November 2020

Terakhir diubah

7 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

EPSS (30 hari)

85,0% peluang dieksploitasi; lebih tinggi dari 99,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://x-stream.github.io/CVE-2020-26217.html exploit · mitigasi · advisory vendor
• https://github.com/x-stream/xstream/commit/0fec095d534126931c99fd38e9c6d41f5c685c1a patch · advisory pihak ketiga
• https://www.oracle.com//security-alerts/cpujul2021.html patch · advisory pihak ketiga
• https://www.oracle.com/security-alerts/cpuApr2021.html patch · advisory pihak ketiga
• https://www.oracle.com/security-alerts/cpuoct2021.html patch · advisory pihak ketiga
• https://github.com/x-stream/xstream/security/advisories/GHSA-mw36-7c6c-q4q2 mitigasi · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2020/12/msg00001.html mailing list · advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20210409-0004/ advisory pihak ketiga
• https://www.debian.org/security/2020/dsa-4811 advisory pihak ketiga
• https://www.oracle.com/security-alerts/cpuapr2022.html not applicable · advisory pihak ketiga
• https://www.oracle.com/security-alerts/cpujan2022.html not applicable · advisory pihak ketiga
• https://lists.apache.org/thread.html/r2de526726e7f4db4a7cb91b7355070779f51a84fd985c6529c2f4e9e%40%3Cissues.act... issue tracking · mailing list
• https://lists.apache.org/thread.html/r7c9fc255edc0b9cd9567093d131f6d33fde4c662aaf912460ef630e9%40%3Ccommits.ca... issue tracking · mailing list
• https://lists.apache.org/thread.html/r826a006fda71cc96fc87b6eca4b5d195f19a292ad36cea501682c38c%40%3Cissues.act... issue tracking · mailing list
• https://lists.apache.org/thread.html/redde3609b89b2a4ff18b536a06ef9a77deb93d47fda8ed28086fa8c3%40%3Cissues.act... issue tracking · mailing list