Red Hat Security Advisory

RHSA-2020:0310

rh-java-common-xmlrpc security update

Released 2020-01-30 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) rh-java-common-xmlrpc-1:3.1.3-8.17.el6, rh-java-common-xmlrpc-client-1:3.1.3-8.17.el6, rh-java-common-xmlrpc-common-1:3.1.3-8.17.el6 +2
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-java-common-xmlrpc-1:3.1.3-8.17.el7, rh-java-common-xmlrpc-client-1:3.1.3-8.17.el7, rh-java-common-xmlrpc-common-1:3.1.3-8.17.el7 +2
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) rh-java-common-xmlrpc-1:3.1.3-8.17.el7, rh-java-common-xmlrpc-client-1:3.1.3-8.17.el7, rh-java-common-xmlrpc-common-1:3.1.3-8.17.el7 +2
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) rh-java-common-xmlrpc-1:3.1.3-8.17.el7, rh-java-common-xmlrpc-client-1:3.1.3-8.17.el7, rh-java-common-xmlrpc-common-1:3.1.3-8.17.el7 +2
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-java-common-xmlrpc-1:3.1.3-8.17.el7, rh-java-common-xmlrpc-client-1:3.1.3-8.17.el7, rh-java-common-xmlrpc-common-1:3.1.3-8.17.el7 +2
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) rh-java-common-xmlrpc-1:3.1.3-8.17.el6, rh-java-common-xmlrpc-client-1:3.1.3-8.17.el6, rh-java-common-xmlrpc-common-1:3.1.3-8.17.el6 +2
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-java-common-xmlrpc-1:3.1.3-8.17.el7, rh-java-common-xmlrpc-client-1:3.1.3-8.17.el7, rh-java-common-xmlrpc-common-1:3.1.3-8.17.el7 +2

Fixes 1 record

TI-2019-13112 CVE-2019-17570 · GHSA-6vwp-35w3-xph8

Deserialization of untrusted data in Apache XML-RPC

HIGH 73

An untrusted deserialization was found in the org.apache.xmlrpc.parser.XmlRpcResponseParser:addResult method of Apache XML-RPC (aka ws-xmlrpc) library.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.49285 Published 2020-01-23 Partial fix CWE-502