XStream 操作系统命令注入漏洞

来源:CONFIRM

链接：https://github.com/x-stream/xstream/commit/0fec095d534126931c99fd38e9c6d41f5c685c1a

来源:MLIST

链接：https://lists.debian.org/debian-lts-announce/2020/12/msg00001.html

来源:MLIST

链接：https://lists.apache.org/thread.html/redde3609b89b2a4ff18b536a06ef9a77deb93d47fda8ed28086fa8c3@%3Cissues.activemq.apache.org%3E

来源:MLIST

链接：https://lists.apache.org/thread.html/r826a006fda71cc96fc87b6eca4b5d195f19a292ad36cea501682c38c@%3Cissues.activemq.apache.org%3E

来源:MLIST

链接：https://lists.apache.org/thread.html/r2de526726e7f4db4a7cb91b7355070779f51a84fd985c6529c2f4e9e@%3Cissues.activemq.apache.org%3E

来源:DEBIAN

链接：https://www.debian.org/security/2020/dsa-4811

来源:CONFIRM

链接：https://x-stream.github.io/CVE-2020-26217.html

来源:CONFIRM

链接：https://github.com/x-stream/xstream/security/advisories/GHSA-mw36-7c6c-q4q2

来源:www.ibm.com

链接：https://www.ibm.com/blogs/psirt/security-bulletin-cve-2020-26217-xstream-before-version-1-4-14-is-vulnerable-to-remote-code-execution-the-vulnerability-may-allow-a-remote-attacker-to-run-arbitrary-shell-commands-only-by-manipulatin/

来源:www.auscert.org.au

链接：https://www.auscert.org.au/bulletins/ESB-2021.0131/

来源:nvd.nist.gov

链接：https://nvd.nist.gov/vuln/detail/CVE-2020-26217

来源:www.auscert.org.au

链接：https://www.auscert.org.au/bulletins/ESB-2021.0210/

来源:www.auscert.org.au

链接：https://www.auscert.org.au/bulletins/ESB-2021.0254/

来源:packetstormsecurity.com

链接：https://packetstormsecurity.com/files/160941/Red-Hat-Security-Advisory-2021-0105-01.html

来源:packetstormsecurity.com

链接：https://packetstormsecurity.com/files/160990/Red-Hat-Security-Advisory-2021-0162-01.html

来源:vigilance.fr

链接：https://vigilance.fr/vulnerability/XStream-code-execution-via-Input-Stream-34006

来源:www.auscert.org.au

链接：https://www.auscert.org.au/bulletins/ESB-2020.4430/