CVE-2019-17570

Published: 23 January 2020

An untrusted deserialization was found in the org.apache.xmlrpc.parser.XmlRpcResponseParser:addResult method of Apache XML-RPC (aka ws-xmlrpc) library. A malicious XML-RPC server could target a XML-RPC client causing it to execute arbitrary code. Apache XML-RPC is no longer maintained and this issue will not be fixed.

Priority

Medium

CVSS 3 base score: 9.8

Status

Package Release Status
libxmlrpc3-java
Launchpad, Ubuntu, Debian
Upstream Needs triage

Ubuntu 20.04 LTS (Focal Fossa) Does not exist

Ubuntu 18.04 LTS (Bionic Beaver)
Released (3.1.3-9+deb10u1build0.18.04.1)
Ubuntu 16.04 ESM (Xenial Xerus)
Released (3.1.3-7+deb8u1build0.16.04.1)
Ubuntu 14.04 ESM (Trusty Tahr) Does not exist