An untrusted deserialization was found in the org.apache.xmlrpc.parser.XmlRpcResponseParser:addResult method of Apache XML-RPC (aka ws-xmlrpc) library. A malicious XML-RPC server could target a XML-RPC client causing it to execute arbitrary code. Apache XML-RPC is no longer maintained and this issue will not be fixed.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - xmlrpc: XML external entity vulnerability SSRF via a crafted DTD (CVE-2016-5002)

  - xmlrpc: Deserialization of server-side exception from faultCause in XMLRPC error response (CVE-2019-17570)

  - The Content-Encoding HTTP header feature in ws-xmlrpc 3.1.3 as used in Apache Archiva allows remote     attackers to cause a denial of service (resource consumption) by decompressing a large file containing     zeroes. (CVE-2016-5004)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote host is affected by the vulnerability described in GLSA-202401-26 (Apache XML-RPC: Multiple Vulnerabilities)

  - XML external entity (XXE) vulnerability in the Apache XML-RPC (aka ws-xmlrpc) library 3.1.3, as used in     Apache Archiva, allows remote attackers to conduct server-side request forgery (SSRF) attacks via a     crafted DTD. (CVE-2016-5002)

  - The Apache XML-RPC (aka ws-xmlrpc) library 3.1.3, as used in Apache Archiva, allows remote attackers to     execute arbitrary code via a crafted serialized Java object in an <ex:serializable> element.
    (CVE-2016-5003)

  - An untrusted deserialization was found in the org.apache.xmlrpc.parser.XmlRpcResponseParser:addResult     method of Apache XML-RPC (aka ws-xmlrpc) library. A malicious XML-RPC server could target a XML-RPC client     causing it to execute arbitrary code. Apache XML-RPC is no longer maintained and this issue will not be     fixed. (CVE-2019-17570)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2080 advisory.

    An untrusted deserialization was found in the org.apache.xmlrpc.parser.XmlRpcResponseParser:addResult     method of Apache XML-RPC (aka ws-xmlrpc) library. A malicious XML-RPC server could target a XML-RPC client     causing it to execute arbitrary code. Apache XML-RPC is no longer maintained and this issue will not be     fixed. (CVE-2019-17570)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:0310 advisory.

    Apache XML-RPC is a Java implementation of XML-RPC, a popular protocol that uses XML over HTTP to     implement remote procedure calls.

    Security Fix(es):

    * xmlrpc: Deserialization of server-side exception from faultCause in XMLRPC error response     (CVE-2019-17570)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4496-1 advisory.

    It was discovered that Apache XML-RPC (aka ws-xmlrpc) does not properly

    deserialize untrusted data. An attacker could possibly use this issue to

    execute arbitrary code. (CVE-2019-17570)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Guillaume Teissier reported that the XMLRPC client in libxmlrpc3-java, an XML-RPC implementation in Java, does perform deserialization of the server-side exception serialized in the faultCause attribute of XMLRPC error response messages. A malicious XMLRPC server can take advantage of this flaw to execute arbitrary code with the privileges of an application using the Apache XMLRPC client library.

Note that a client that expects to get server-side exceptions need to set explicitly the enabledForExceptions property.

An untrusted deserialization was found in the org.apache.xmlrpc.parser.XmlRpcResponseParser:addResult method of Apache XML-RPC (aka ws-xmlrpc) library. A malicious XML-RPC server could target a XML-RPC client causing it to execute arbitrary code.

Clients that expect to get server-side exceptions need to set the enabledForExceptions property to true in order to process serialized exception messages again.

For Debian 8 'Jessie', this problem has been fixed in version 3.1.3-7+deb8u1.

We recommend that you upgrade your libxmlrpc3-java packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
198745	RHEL 7 : xmlrpc (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
189291	GLSA-202401-26 : Apache XML-RPC: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	critical
176895	Amazon Linux 2 : xmlrpc (ALAS-2023-2080)	Nessus	Amazon Linux Local Security Checks	critical
170326	RHEL 6 / 7 : rh-java-common-xmlrpc (RHSA-2020:0310)	Nessus	Red Hat Local Security Checks	critical
140593	Ubuntu 16.04 LTS / 18.04 LTS : Apache XML-RPC vulnerability (USN-4496-1)	Nessus	Ubuntu Local Security Checks	critical
133534	Debian DSA-4619-1 : libxmlrpc3-java - security update	Nessus	Debian Local Security Checks	critical
133362	Debian DLA-2078-1 : libxmlrpc3-java security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2019-17570

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical