Details
-
Bug
-
Resolution: Fixed
-
Low
-
7.10.0, 7.13.0
-
17
-
Severity 2 - Major
-
4
-
Description
Problem
XStream is vulnerable to security exploits such as highlighted in the image attached.
The list of CVEs can be found in https://x-stream.github.io/security.html
This ticket tracks its upgrade to 1.4.18.
Environment
Confluence v7.13
Workaround
Set xstream.allowlist.enable sysprop to true. This is equivalent to XStream 1.4.18 behaviour and it exist in Confluence 7.10 and up. But it comes with a risk of broken third-party plugins which have not yet configured xstream-security module with their classes. Confirm with Third-party plugin vendors before toggling it if your Confluence instance uses a third-party plugin and it relies on XStream.
Attachments
Issue Links
- links to
- mentioned in
-
Page Loading...
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-