xstream-1.3.1-12.el7

XStream is a Java XML serialization library to serialize objects to and deserialize object from XML.

Security Fix(es):

* XStream: remote code execution due to insecure XML deserialization when relying on blocklists (CVE-2020-26217)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

CVE-2020-26217
XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream. Only users who rely on blocklists are affected. Anyone using XStream's Security Framework allowlist is not affected. The linked advisory provides code workarounds for users who cannot upgrade. The issue is fixed in version 1.4.14.