RHSA-2021:2476MediumCVSS 8.5

Red Hat Security Advisory: Red Hat Decision Manager 7.11.0 security update

Published
June 17, 2021
Last Modified
August 4, 2026

🔗 CVE IDs covered (15)

CVE-2020-26259 →CVE-2021-21343 →CVE-2021-21345 →CVE-2021-21346 →CVE-2021-21347 →CVE-2021-21351 →CVE-2021-21341 →CVE-2021-21344 →CVE-2021-21349 →CVE-2021-21348 →CVE-2020-25649 →CVE-2021-21342 →CVE-2020-11988 →CVE-2021-21350 →CVE-2020-26258 →

📋 Description

CVE-2020-11988 — xmlgraphics-commons: SSRF due to improper input validation by the XMPParser CVE-2020-25649 — jackson-databind: FasterXML DOMDeserializer insecure entity expansion is vulnerable to XML external entity (XXE) CVE-2020-26258 — XStream: Server-Side Forgery Request vulnerability can be activated when unmarshalling CVE-2020-26259 — XStream: arbitrary file deletion on the local host when unmarshalling CVE-2021-21341 — XStream: allow a remote attacker to cause DoS only by manipulating the processed input stream CVE-2021-21342 — XStream: SSRF via crafted input stream CVE-2021-21343 — XStream: arbitrary file deletion on the local host via crafted input stream CVE-2021-21344 — XStream: Unsafe deserizaliation of javax.sql.rowset.BaseRowSet CVE-2021-21345 — XStream: Unsafe deserizaliation of com.sun.corba.se.impl.activation.ServerTableEntry CVE-2021-21346 — XStream: Unsafe deserizaliation of sun.swing.SwingLazyValue CVE-2021-21347 — XStream: Unsafe deserizaliation of com.sun.tools.javac.processing.JavacProcessingEnvironment NameProcessIterator CVE-2021-21348 — XStream: ReDoS vulnerability CVE-2021-21349 — XStream: SSRF can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host CVE-2021-21350 — XStream: Unsafe deserizaliation of com.sun.org.apache.bcel.internal.util.ClassLoader CVE-2021-21351 — XStream: allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream

🎯 Affected products1

  • RHDM 7.11.0

✅ Remediation

For on-premise installations, before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. It is recommended to halt the server by stopping the JBoss Application Server process before installing this update; after installing the update, restart the server by starting the JBoss Application Server process. The References section of this erratum contains a download link (you must log in to download the update). Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: There is currently no known mitigation for this flaw. Workaround: As recommended, use XStream's security framework to implement a whitelist for the allowed types. Users of XStream 1.4.14 who insist to use XStream default blacklist - despite that clear recommendation - can simply add two lines to XStream's setup code: xstream.denyTypes(new String[]{ "jdk.nashorn.internal.objects.NativeString" }); xstream.denyTypesByRegExp(new String[]{ ".*\\.ReadAllStream\\$FileStream" }); Users of XStream 1.4.13 who want to use XStream default blacklist can simply add three lines to XStream's setup code: xstream.denyTypes(new String[]{ "javax.imageio.ImageIO$ContainsFilter", "jdk.nashorn.internal.objects.NativeString" }); xstream.denyTypes(new Class[]{ java.lang.ProcessBuilder.class }); xstream.denyTypesByRegExp(new String[]{ ".*\\.ReadAllStream\\$FileStream" }); Users of XStream 1.4.12 to 1.4.7 who want to use XStream with a blacklist will have to setup such a list from scratch and deny at least the following types: javax.imageio.ImageIO$ContainsFilter, java.beans.EventHandler, java.lang.ProcessBuilder, jdk.nashorn.internal.objects.NativeString, java.lang.Void and void and deny several types by name pattern. xstream.denyTypes(new String[]{ "javax.imageio.ImageIO$ContainsFilter", "jdk.nashorn.internal.objects.NativeString" }); xstream.denyTypes(new Class[]{ java.lang.ProcessBuilder.class, java.beans.EventHandler.class, java.lang.ProcessBuilder.class, java.lang.Void.class, void.class }); xstream.denyTypesByRegExp(new String[]{ ".*\\$LazyIterator", "javax\\.crypto\\..*", ".*\\.ReadAllStream\\$FileStream" }); Users of XStream 1.4.6 or below can register an own converter to prevent the unmarshalling of the currently know critical types of the Java runtime. It is in fact an updated version of the workaround for CVE-2013-7285: xstream.registerConverter(new Converter() { public boolean canConvert(Class type) { return type != null && (type == java.beans.EventHandler.class || type == java.lang.ProcessBuilder.class || type.getName().equals("javax.imageio.ImageIO$ContainsFilter") || type.getName().equals("jdk.nashorn.internal.objects.NativeString") || type == java.lang.Void.class || void.class || Proxy.isProxy(type) || type.getName().startsWith("javax.crypto.") || type.getName().endsWith("$LazyIterator") || type.getName().endsWith(".ReadAllStream$FileStream")); } public Object unmarshal(HierarchicalStreamReader reader, UnmarshallingContext context) { throw new ConversionException("Unsupported type due to security reasons."); } public void marshal(Object source, HierarchicalStreamWriter writer, MarshallingContext context) { throw new ConversionException("Unsupported type due to security reasons."); } }, XStream.PRIORITY_LOW);

🔗 References (18)