CVE-2019-10173

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw. If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when unmarshalling XML or any supported format. e.g. JSON. (regression of CVE-2013-7285)

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94 CWE-502

Affected software

Vendor	Product	Versions
xstream	xstream	fixed in 1.4.11

References

http://x-stream.github.io/changes.html#1.4.11Release Notes, Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3892Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:4352Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0445Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0727Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10173Issue Tracking, Third Party Advisory
https://www.oracle.com//security-alerts/cpujul2021.htmlPatch, Third Party Advisory
https://www.oracle.com/security-alerts/cpuApr2021.htmlPatch, Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2020.htmlThird Party Advisory
https://www.oracle.com/security-alerts/cpujan2021.htmlThird Party Advisory
https://www.oracle.com/security-alerts/cpuoct2020.htmlThird Party Advisory
http://x-stream.github.io/changes.html#1.4.11Release Notes, Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3892Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:4352Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0445Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0727Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10173Issue Tracking, Third Party Advisory
https://www.oracle.com//security-alerts/cpujul2021.htmlPatch, Third Party Advisory
https://www.oracle.com/security-alerts/cpuApr2021.htmlPatch, Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2020.htmlThird Party Advisory
https://www.oracle.com/security-alerts/cpujan2021.htmlThird Party Advisory
https://www.oracle.com/security-alerts/cpuoct2020.htmlThird Party Advisory

Timeline

Published: Jul 23, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-101748.8A vulnerability was found in Infinispan such that the invokeAccessibly method from the public class ReflectionUtil allows any application cl CVE-2019-101756.5A flaw was found in the containerized-data-importer in virt-cdi-cloner, version 1.4, where the host-assisted cloning feature does not determ CVE-2019-101765.4A flaw was found in OpenShift Container Platform, versions 3.11 and later, in which the CSRF tokens used in the cluster console component we CVE-2019-101776.5A stored cross-site scripting (XSS) vulnerability was found in the PDF export component of CloudForms, versions 5.9 and 5.10, due to user in CVE-2019-101786.1It was found that the Token Processing Service (TPS) did not properly sanitize the Token IDs from the "Activity" page, enabling a Stored Cro CVE-2019-101796.1A vulnerability was found in all pki-core 10.x.x versions, where the Key Recovery Authority (KRA) Agent Service did not properly sanitize re CVE-2019-10187.0An elevation of privilege vulnerability exists when DirectX improperly handles objects in memory. An attacker who successfully exploited thi CVE-2019-101804.8A vulnerability was found in all pki-core 10.x.x version, where the Token Processing Service (TPS) did not properly sanitize several paramet CVE-2019-101818.1It was found that in icedtea-web up to and including 1.7.2 and 1.8.2 executable code could be injected in a JAR file without compromising th CVE-2019-101826.5It was found that icedtea-web though 1.7.2 and 1.8.2 did not properly sanitize paths from <jar/> elements in JNLP files. An attacker could t CVE-2019-101833.3Virt-install(1) utility used to provision new virtual machines has introduced an option '--unattended' to create VMs without user interactio CVE-2019-101847.5undertow before version 2.0.23.Final is vulnerable to an information leak issue. Web apps may have their directory structures predicted thro