vulnerability

Ubuntu: USN-4496-1 (CVE-2019-17570): Apache XML-RPC vulnerability

Try Surface Command

Back to search

Severity

CVSS

(AV:N/AC:L/Au:N/C:P/I:P/A:P)

Published

Jan 23, 2020

Added

Sep 16, 2020

Modified

Mar 27, 2026

Description

An untrusted deserialization was found in the org.apache.xmlrpc.parser.XmlRpcResponseParser:addResult method of Apache XML-RPC (aka ws-xmlrpc) library. A malicious XML-RPC server could target a XML-RPC client causing it to execute arbitrary code. Apache XML-RPC is no longer maintained and this issue will not be fixed.

Solutions

ubuntu-upgrade-libxmlrpc3-client-javaubuntu-upgrade-libxmlrpc3-common-javaubuntu-upgrade-libxmlrpc3-server-java

References

CVE-2019-17570
https://attackerkb.com/topics/CVE-2019-17570
CWE-502
DEBIAN-DSA-4619
EUVD-EUVD-2020-0468
NVD-CVE-2019-17570
UBUNTU-USN-4496-1
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-0468

Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.

Get report