CVE-2019-17570

 

Published at: - 23-01-2020 11:15

Last modified: - 03-09-2022 05:40

Total changes: - 3

Description

An untrusted deserialization was found in the org.apache.htmlrpc.parser.XmlRpcResponseParser:addResult method of Apache XML-RPC (aka ws-xmlrpc) library. A malicious XML-RPC server could target a XML-RPC client causing it to execute arbitrary code. Apache XML-RPC is no longer maintained and this issue will not be fixed.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

 

Verification logic

 

Reference

• https://lists.apache.org/thread.html/846551673bbb7ec8d691008215384bcef03a3fb004d2da845cfe88ee%401390230951%40%3Cdev.ws.apache.org%3E
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-17570;
• [oss-security] 20200124 RE: [CVE-2019-17570] xmlrpc-common untrusted deserialization-Mailing List, Third Party Advisory
• [debian-lts-announce] 20200130 [SECURITY] [DLA 2078-1] libxmlrpc3-java security update-Mailing List, Third Party Advisory
• RHSA-2020:0310-Third Party Advisory
• DSA-4619-Third Party Advisory
• 20200210 [SECURITY] [DSA 4619-1] libxmlrpc3-java security update-Mailing List, Third Party Advisory
• FEDORA-2020-1d0635bd71-Mailing List, Third Party Advisory
• USN-4496-1-Patch, Third Party Advisory
• https://github.com/orangecertcc/security-research/security/advisories/GHSA-x2r6-4m45-m4jp

 

Keywords

NVD

 

CVE-2019-17570

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures