vulnerability

Amazon Linux AMI 2: CVE-2019-17570: Security patch for xmlrpc (ALAS-2023-2080)

Try Surface Command

Back to search

Severity	CVSS	Published	Added	Modified
8	(AV:N/AC:L/Au:N/C:P/I:P/A:P)	Jan 23, 2020	Jun 8, 2023	Nov 27, 2024

Severity

CVSS

(AV:N/AC:L/Au:N/C:P/I:P/A:P)

Published

Jan 23, 2020

Added

Jun 8, 2023

Modified

Nov 27, 2024

Description

An untrusted deserialization was found in the org.apache.xmlrpc.parser.XmlRpcResponseParser:addResult method of Apache XML-RPC (aka ws-xmlrpc) library. A malicious XML-RPC server could target a XML-RPC client causing it to execute arbitrary code. Apache XML-RPC is no longer maintained and this issue will not be fixed.

Solutions

amazon-linux-ami-2-upgrade-xmlrpc-clientamazon-linux-ami-2-upgrade-xmlrpc-commonamazon-linux-ami-2-upgrade-xmlrpc-javadocamazon-linux-ami-2-upgrade-xmlrpc-server

References

AMAZON-AL2/ALAS-2023-2080
CVE-2019-17570
https://attackerkb.com/topics/CVE-2019-17570

NEW

Explore Exposure Command

Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.

Try it today