REDHAT-BUG-1508123
First published: Tue Oct 31 2017(Updated: )
The Apache XML-RPC (aka ws-xmlrpc) library 3.1.3, as used in Apache Archiva, allows remote attackers to execute arbitrary code via a crafted serialized Java object in an <ex:serializable> element. References: <a href="http://www.openwall.com/lists/oss-security/2016/07/12/5">http://www.openwall.com/lists/oss-security/2016/07/12/5</a> <a href="https://0ang3el.blogspot.in/2016/07/beware-of-ws-xmlrpc-library-in-your.html">https://0ang3el.blogspot.in/2016/07/beware-of-ws-xmlrpc-library-in-your.html</a>
| Affected Software | Affected Version | How to fix |
|---|---|---|
| PHP XML-RPC | ||
| Apache Archiva |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.openwall.com/lists/oss-security/2016/07/12/5
- https://0ang3el.blogspot.in/2016/07/beware-of-ws-xmlrpc-library-in-your.html
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1508124
- https://ws.apache.org/xmlrpc/extensions.html
- https://access.redhat.com/errata/RHSA-2018:1779
- https://access.redhat.com/errata/RHSA-2018:1780
- https://access.redhat.com/errata/RHSA-2018:1784
- https://access.redhat.com/errata/RHSA-2018:2317
- https://access.redhat.com/errata/RHSA-2018:3768
- https://src.fedoraproject.org/rpms/xmlrpc/c/ef4efbf91d241070f6f41950f7536049688a3a67?branch=master
- https://bugzilla.redhat.com/show_bug.cgi?id=1508123
Frequently Asked Questions
What is the severity of REDHAT-BUG-1508123?
The severity of REDHAT-BUG-1508123 is critical due to the potential for remote code execution.
How do I fix REDHAT-BUG-1508123?
To fix REDHAT-BUG-1508123, update the Apache XML-RPC library to the latest version that addresses this vulnerability.
Who is affected by REDHAT-BUG-1508123?
Users of Apache XML-RPC and Apache Archiva are potentially affected by REDHAT-BUG-1508123.
What type of attack does REDHAT-BUG-1508123 enable?
REDHAT-BUG-1508123 enables remote attackers to execute arbitrary code using crafted serialized Java objects.
What component is vulnerable in REDHAT-BUG-1508123?
The vulnerable component in REDHAT-BUG-1508123 is the Apache XML-RPC library version 3.1.3.
- agent/type
- agent/first-publish-date
- agent/last-modified-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2016-5003
- agent/source
- agent/severity
- agent/references
- agent/description
- agent/event
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/apache
- canonical/php xml-rpc
- canonical/apache archiva