An untrusted deserialization was found in the org.apache.xmlrpc.parser.XmlRpcResponseParser:addResult method of Apache XML-RPC (aka ws-xmlrpc) library. A malicious XML-RPC server could target a XML-RPC client causing it to execute arbitrary code. Apache XML-RPC is no longer maintained and this issue will not be fixed.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - xmlrpc: XML external entity vulnerability SSRF via a crafted DTD (CVE-2016-5002)

  - xmlrpc: Deserialization of server-side exception from faultCause in XMLRPC error response (CVE-2019-17570)

  - The Content-Encoding HTTP header feature in ws-xmlrpc 3.1.3 as used in Apache Archiva allows remote     attackers to cause a denial of service (resource consumption) by decompressing a large file containing     zeroes. (CVE-2016-5004)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote host is affected by the vulnerability described in GLSA-202401-26 (Apache XML-RPC: Multiple Vulnerabilities)

  - XML external entity (XXE) vulnerability in the Apache XML-RPC (aka ws-xmlrpc) library 3.1.3, as used in     Apache Archiva, allows remote attackers to conduct server-side request forgery (SSRF) attacks via a     crafted DTD. (CVE-2016-5002)

  - The Apache XML-RPC (aka ws-xmlrpc) library 3.1.3, as used in Apache Archiva, allows remote attackers to     execute arbitrary code via a crafted serialized Java object in an <ex:serializable> element.
    (CVE-2016-5003)

  - An untrusted deserialization was found in the org.apache.xmlrpc.parser.XmlRpcResponseParser:addResult     method of Apache XML-RPC (aka ws-xmlrpc) library. A malicious XML-RPC server could target a XML-RPC client     causing it to execute arbitrary code. Apache XML-RPC is no longer maintained and this issue will not be     fixed. (CVE-2019-17570)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2080 advisory.

  - An untrusted deserialization was found in the org.apache.xmlrpc.parser.XmlRpcResponseParser:addResult     method of Apache XML-RPC (aka ws-xmlrpc) library. A malicious XML-RPC server could target a XML-RPC client     causing it to execute arbitrary code. Apache XML-RPC is no longer maintained and this issue will not be     fixed. (CVE-2019-17570)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:0310 advisory.

  - xmlrpc: Deserialization of server-side exception from faultCause in XMLRPC error response (CVE-2019-17570)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4496-1 advisory.

  - An untrusted deserialization was found in the org.apache.xmlrpc.parser.XmlRpcResponseParser:addResult     method of Apache XML-RPC (aka ws-xmlrpc) library. A malicious XML-RPC server could target a XML-RPC client     causing it to execute arbitrary code. Apache XML-RPC is no longer maintained and this issue will not be     fixed. (CVE-2019-17570)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Guillaume Teissier reported that the XMLRPC client in libxmlrpc3-java, an XML-RPC implementation in Java, does perform deserialization of the server-side exception serialized in the faultCause attribute of XMLRPC error response messages. A malicious XMLRPC server can take advantage of this flaw to execute arbitrary code with the privileges of an application using the Apache XMLRPC client library.

Note that a client that expects to get server-side exceptions need to set explicitly the enabledForExceptions property.

An untrusted deserialization was found in the org.apache.xmlrpc.parser.XmlRpcResponseParser:addResult method of Apache XML-RPC (aka ws-xmlrpc) library. A malicious XML-RPC server could target a XML-RPC client causing it to execute arbitrary code.

Clients that expect to get server-side exceptions need to set the enabledForExceptions property to true in order to process serialized exception messages again.

For Debian 8 'Jessie', this problem has been fixed in version 3.1.3-7+deb8u1.

We recommend that you upgrade your libxmlrpc3-java packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
198745	RHEL 7 : xmlrpc (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
189291	GLSA-202401-26 : Apache XML-RPC: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	critical
176895	Amazon Linux 2 : xmlrpc (ALAS-2023-2080)	Nessus	Amazon Linux Local Security Checks	critical
170326	RHEL 6 / 7 : rh-java-common-xmlrpc (RHSA-2020:0310)	Nessus	Red Hat Local Security Checks	critical
140593	Ubuntu 16.04 LTS / 18.04 LTS : Apache XML-RPC vulnerability (USN-4496-1)	Nessus	Ubuntu Local Security Checks	critical
133534	Debian DSA-4619-1 : libxmlrpc3-java - security update	Nessus	Debian Local Security Checks	critical
133362	Debian DLA-2078-1 : libxmlrpc3-java security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2019-17570

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical