DSA-4811-1 libxstream-java -- libxstream-javaID: oval:org.secpod.oval:def:605344 | Date: (C)2020-12-18 (M)2023-11-13 |
Class: PATCH | Family: unix |
It was discovered that the default blacklist of XStream, a Java library to serialise objects to XML and back again, was vulnerable to the execution of arbitrary shell commands by manipulating the processed input stream. For additional defense-in-depth it is recommended to switch to the whitelist approach of XStream"s security framework. For additional information please refer to https://github.com/x-stream/xstream/security/advisories/GHSA-mw36-7c6c-q4q2