Yüksek CVSS 7.5
CVE-2017-7957: Fuse: hatalı girdi doğrulama
Açıklama (NVD)
XStream through 1.4.9, when a certain denyTypes workaround is not used, mishandles attempts to create an instance of the primitive type 'void' during unmarshalling, leading to a remote application crash, as demonstrated by an xstream.fromXML("<void/>") call.
Özet bilgiler
- Ürün
- Redhat Fuse
- CVSS v3.1
- 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - EPSS
- %4,93 (yüzdelik 92)
- CWE
- CWE-20
- Yama
- Yok / bilinmiyor
Etkilenen sürümler
| Ürün | Başlangıç | Bitiş | Düzeltildi |
|---|---|---|---|
| redhat-fuse | 1.0 | 1.0 | — |
| redhat-jboss-middleware | 1 | 1 | — |
| xstream-xstream | — | 1.4.9 | — |
| debian-debian-linux | 8.0 | 8.0 | — |
| debian-debian-linux | 9.0 | 9.0 | — |
Kaynaklar
- NVD kaydı
- www.debian.org
- www.securityfocus.com
- www.securitytracker.com
- x-stream.github.io
- access.redhat.com
- access.redhat.com
- access.redhat.com
- exchange.xforce.ibmcloud.com
- www-prd-trops.events.ibm.com
- www.debian.org
- www.securityfocus.com
- www.securitytracker.com
- x-stream.github.io
- access.redhat.com
- access.redhat.com
- access.redhat.com
- exchange.xforce.ibmcloud.com
- www-prd-trops.events.ibm.com
- CWE-20