| Package | Affected versions | Patched versions |
|---|---|---|
| com.thoughtworks.xstream:xstream | < 1.4.10 | 1.4.10 |
| fuse | = 1.0 | |
| jboss middleware | = 1 | |
| xstream | ≤ 1.4.9 |
XStream through 1.4.9, when a certain denyTypes workaround is not used, mishandles attempts to create an instance of the primitive type 'void' during unmarshalling, leading to a remote application crash, as demonstrated by an xstream.fromXML("<void/>") call.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free