Advisoriesby IbisOracleGHSA-f6v3-cvph-88fm
unrestricted XML decoding
Fix: upgrade to 1.6.9 or later
Impact
Decoding objects serialized in XML (Configuration, History, plugin Configuration) can result in arbitrary execution. This is especially true when using the RESTful API call to set the configuration. Note that this requires the use of bearer token if using outside of localhost.
Discovered by Bobby Rauch (Accenture).
Patches
The XML decoders used in the project were patched in 1.6.9 and later.
Workarounds
N/A
References
https://github.com/oracle/opengrok/pull/3526
https://github.com/oracle/opengrok/pull/3527
https://github.com/oracle/opengrok/pull/3528
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| opengrok Product | < 1.6.9 | 1.6.9 |
Details and references
- Severity from
- GitHub (reviewed advisory)