CVE-2019-17570: Critical severity Apache XML-RPC vulnerability
A flaw was discovered where the XMLRPC client implementation in Apache XMLRPC, performed deserialization of the server-side exception serialized in the faultCause attribute of XMLRPC error response messages. A malicious or compromised XMLRPC server could possibly use this flaw to execute arbitrary code with the privileges of an application using the Apache XMLRPC client library.
Other sources
An untrusted deserialization was found in the org.apache.xmlrpc.parser.XmlRpcResponseParser:addResult method of Apache XML-RPC (aka ws-xmlrpc) library. A malicious XML-RPC server could target a XML-RPC client causing it to execute arbitrary code.
Apache XML-RPC is no longer maintained and this issue will not be fixed.
— GitHub
Guillaume Teissier reported a flaw in Apache XMLRPC:
Java untrusted deserialization in faultCause when processing an XMLRPC response. XMLRPC clients are thus targeted by this vulnerability, and rogue XMLRPC servers may gain arbitrary code execution on the XMLRPC client.
The vulnerability lays in the org.apache.xmlrpc.parser.XmlRpcResponseParser:addResult(Object) method.
This vulnerability is different from CVE-2016-5003, which uses ex:serializable type to perform deserialization. This new vulnerability only affects XMLRPC clients, which will receive response, possible faults. It is exploitable in default configuration.
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Information
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2019-17570?
CVE-2019-17570 is a vulnerability that allows for untrusted deserialization in the Apache XMLRPC client implementation.
How does CVE-2019-17570 affect Apache XMLRPC?
CVE-2019-17570 affects Apache XMLRPC by allowing a malicious XMLRPC server to execute arbitrary code.
What is the severity of CVE-2019-17570?
CVE-2019-17570 is rated as critical with a severity value of 9.8.
Which software versions are affected by CVE-2019-17570?
CVE-2019-17570 affects versions 3.1 to 3.1.3 of Apache XML-RPC and versions 3.1.3-8+deb9u1 to 3.1.3-9+deb10u1 of libxmlrpc3-java.
How can I fix the CVE-2019-17570 vulnerability?
To fix the CVE-2019-17570 vulnerability, update to version 3.1.3-8.17.el6 or later for rh-java-common-xmlrpc on Red Hat systems, or version 3.1.3-9+deb10u1 or later for libxmlrpc3-java on Debian systems.