Red Hat Security AdvisoryRHSA-2018:1779
xmlrpc3 security update
Released 2018-05-31 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Server (v. 6) xmlrpc3-3.0-4.17.el6_9, xmlrpc3-client-3.0-4.17.el6_9, xmlrpc3-common-3.0-4.17.el6_9
- Red Hat Enterprise Linux Server Optional (v. 6) xmlrpc3-client-devel-3.0-4.17.el6_9, xmlrpc3-common-devel-3.0-4.17.el6_9, xmlrpc3-javadoc-3.0-4.17.el6_9 +2
- Red Hat Enterprise Linux Workstation (v. 6) xmlrpc3-3.0-4.17.el6_9, xmlrpc3-client-3.0-4.17.el6_9, xmlrpc3-common-3.0-4.17.el6_9
- Red Hat Enterprise Linux Workstation Optional (v. 6) xmlrpc3-client-devel-3.0-4.17.el6_9, xmlrpc3-common-devel-3.0-4.17.el6_9, xmlrpc3-javadoc-3.0-4.17.el6_9 +2
Fixes 1 record
Priority MEDIUM 58
The Apache XML-RPC (aka ws-xmlrpc) library 3.1.3, as used in Apache Archiva, allows remote attackers to execute arbitrary code via a crafted serialized Java object in an <ex:serializable> element.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.14876 · Published 2017-10-27 · Partial fix CWE-502
