Red Hat Security AdvisoryRHSA-2018:1780
xmlrpc security update
Released 2018-05-31 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client Optional (v. 7) xmlrpc-1:3.1.3-9.el7_5, xmlrpc-client-1:3.1.3-9.el7_5, xmlrpc-common-1:3.1.3-9.el7_5 +2
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) xmlrpc-1:3.1.3-9.el7_5, xmlrpc-client-1:3.1.3-9.el7_5, xmlrpc-common-1:3.1.3-9.el7_5 +2
- Red Hat Enterprise Linux Server Optional (v. 7) xmlrpc-1:3.1.3-9.el7_5, xmlrpc-client-1:3.1.3-9.el7_5, xmlrpc-common-1:3.1.3-9.el7_5 +2
- Red Hat Enterprise Linux Workstation Optional (v. 7) xmlrpc-1:3.1.3-9.el7_5, xmlrpc-client-1:3.1.3-9.el7_5, xmlrpc-common-1:3.1.3-9.el7_5 +2
- Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7) xmlrpc-1:3.1.3-9.el7_5, xmlrpc-client-1:3.1.3-9.el7_5, xmlrpc-common-1:3.1.3-9.el7_5 +2
Fixes 1 record
Priority MEDIUM 58
The Apache XML-RPC (aka ws-xmlrpc) library 3.1.3, as used in Apache Archiva, allows remote attackers to execute arbitrary code via a crafted serialized Java object in an <ex:serializable> element.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.14876 · Published 2017-10-27 · Partial fix CWE-502
