Accepted libxstream-java 1.4.11.1-1+deb10u2 (source) into proposed-updates->stable-new, proposed-updates
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Thu, 31 Dec 2020 14:15:35 +0100
Source: libxstream-java
Architecture: source
Version: 1.4.11.1-1+deb10u2
Distribution: buster-security
Urgency: high
Maintainer: Debian Java Maintainers <pkg-java-maintainers@lists.alioth.debian.org>
Changed-By: Markus Koschany <apo@debian.org>
Changes:
libxstream-java (1.4.11.1-1+deb10u2) buster-security; urgency=high
.
* Team upload.
* Fix CVE-2020-26258:
XStream is vulnerable to a Server-Side Forgery Request which can be
activated when unmarshalling. The vulnerability may allow a remote attacker
to request data from internal resources that are not publicly available
only by manipulating the processed input stream.
* Fix CVE-2020-26259:
Xstream is vulnerable to an Arbitrary File Deletion on the local host when
unmarshalling. The vulnerability may allow a remote attacker to delete
arbitrary known files on the host as long as the executing process has
sufficient rights only by manipulating the processed input stream.
Checksums-Sha1:
de4bf90a01a1fded61955776c68c71189b5d7802 2591 libxstream-java_1.4.11.1-1+deb10u2.dsc
82a343682d868dbaeccac133d4fd7417af773213 11140 libxstream-java_1.4.11.1-1+deb10u2.debian.tar.xz
a3ee8843236ef9054d66e3dc92f0dda7597e3fae 16341 libxstream-java_1.4.11.1-1+deb10u2_amd64.buildinfo
Checksums-Sha256:
6c8ff9c70eded5a4d051f18fc18d53b02941010b1a2d6a24511cbdd556a1bca8 2591 libxstream-java_1.4.11.1-1+deb10u2.dsc
416f144df987d9b8f241d9f5639cd8f7698eeb69b62cc2d6396a3ef189088543 11140 libxstream-java_1.4.11.1-1+deb10u2.debian.tar.xz
27bdaf3afac8f99f9fff1d328dbd9b7cc84d5ebdfa7032f4db78b66901b08a87 16341 libxstream-java_1.4.11.1-1+deb10u2_amd64.buildinfo
Files:
49440f63293cb30cf45897e45e0daef7 2591 java optional libxstream-java_1.4.11.1-1+deb10u2.dsc
576da1441ae932b78e6b733bb1aba4c9 11140 java optional libxstream-java_1.4.11.1-1+deb10u2.debian.tar.xz
ca5476e5320636f14d1f8fd3a23dd8ac 16341 java optional libxstream-java_1.4.11.1-1+deb10u2_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQKjBAEBCgCNFiEErPPQiO8y7e9qGoNf2a0UuVE7UeQFAl/02tlfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEFD
RjNEMDg4RUYzMkVERUY2QTFBODM1RkQ5QUQxNEI5NTEzQjUxRTQPHGFwb0BkZWJp
YW4ub3JnAAoJENmtFLlRO1HkN9sP/0k+2N7dqDzA5ZnXnRxSw6Ke8pW6aLCk4jg0
YSp2bNGn9z+fjm0sSZLXg34WE+LaOU8/pKSVpgLHWYZi7t0rMulfJvgrRYZ/C5Hr
u0FWN7G2D+KI1qpxXZImcxt9x46iUCW8cqIMHqMm6HSYNHqm5vfD1gubm44/m+Xi
/oAo2rE/K9Rf2nzKtGXjhiela6KppjZaV7Kurggy1csfbt3G2uxAkosK47z+5vjz
ppKtzGU/SdLzEtl3BdMU/LGbW7saYjDQHRzfOMqUE1xMkH7n0BPyx8kz3wCUASAH
Qzd1dq/kBHAztBxCPyG8IflnMVXQK+/M3E82O8u/kfITb4PE2Rqp8NkNbFHNYZ+E
kYxM3wkmRv2vX22C8gNXufHHI7Po7ivmyiSByZpxMw+PNRec/13fHjMT1vkhqaqm
q3q6cu+mQhxzBzyIwwg18RiZaR4lDpiqW9RaYV7g1kho/JKM94B8yafNMGCW36N4
rK9zSKHUZH9FPXw0qGzIMHEaH3yGIOBgiJcsbJK7CBY4gbJRvb9tjx9dIi5tMHmL
M92qH2j7AlU4cxwlDCRl2s/j5jAo7/w5z3rQXkTlS2xnwR38r1I2IfV3v9Z2MXPZ
jU0hn0QvzSz7fx8hcujob5U/QNP53811FM8+JY0BRCPg6bcXg71IKWH2Dzin1Pmi
bYQdAGJU
=ddmX
-----END PGP SIGNATURE-----