{"id":"CVE-2017-7957","published":"2017-04-29T19:00:00Z","modified":"2026-10-08T21:03:12Z","title":"XStream through 1.4.9, when a certain denyTypes workaround is not used, mishandles attempts to create an instance of…","vendor":null,"product":null,"tier":"tail","description":{"text":"XStream through 1.4.9, when a certain denyTypes workaround is not used, mishandles attempts to create an instance of the primitive type 'void' during unmarshalling, leading to a remote application crash, as demonstrated by an xstream.fromXML(\"<void/>\") call.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.04928,"percentile":0.92111,"provenance":"source"},"cwes":[],"references":[{"url":"https://access.redhat.com/errata/RHSA-2017:2888","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2017:1832","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2017:2889","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://www.securitytracker.com/id/1039499","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"https://www-prd-trops.events.ibm.com/node/715749","tags":["x_refsource_CONFIRM"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/125800","tags":["vdb-entry","x_refsource_XF"]},{"url":"http://www.debian.org/security/2017/dsa-3841","tags":["vendor-advisory","x_refsource_DEBIAN"]},{"url":"http://x-stream.github.io/CVE-2017-7957.html","tags":["x_refsource_CONFIRM"]},{"url":"http://www.securityfocus.com/bid/100687","tags":["vdb-entry","x_refsource_BID"]}],"priority":{"score":18.4,"factors":[{"name":"EPSS percentile","points":18.42}]},"affected":[{"ecosystem":"Maven","package":"com.thoughtworks.xstream:xstream","vulnerableRanges":["<1.4.10"],"patched":["1.4.10"],"from":["GHSA-7hwc-46rm-65jh"],"provenance":"source"}],"euvd":{"id":"EUVD-2020-0471","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-x-stream-xstream-cve-2017-7957","children":[{"from":"CVE-2017-7957","to":"CVE-2013-7285","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["xstream/src/java/com/thoughtworks/xstream/XStream.java","xstream/src/java/com/thoughtworks/xstream/security/PrimitiveTypePermission.java"],"commits":["https://github.com/x-stream/xstream/commit/6344867dce6767af7d0fe34fb393271a6456672d","https://github.com/x-stream/xstream/commit/6e546ec366419158b1e393211be6d78ab9604abe","https://github.com/x-stream/xstream/commit/8542d02d9ac5d384c85f4b33d6c1888c53bd55d3"],"basis":"shared function","functions":["XStream","autodetectAnnotations"]}]},{"from":"CVE-2017-7957","to":"CVE-2020-26217","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["xstream/src/java/com/thoughtworks/xstream/XStream.java"],"commits":["https://github.com/x-stream/xstream/commit/6e546ec366419158b1e393211be6d78ab9604abe","https://github.com/x-stream/xstream/commit/8542d02d9ac5d384c85f4b33d6c1888c53bd55d3","https://github.com/x-stream/xstream/commit/0fec095d534126931c99fd38e9c6d41f5c685c1a"],"basis":"shared function","functions":["setupSecurity"]}]},{"from":"CVE-2017-7957","to":"CVE-2021-43859","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["xstream/src/java/com/thoughtworks/xstream/XStream.java"],"commits":["https://github.com/x-stream/xstream/commit/6e546ec366419158b1e393211be6d78ab9604abe","https://github.com/x-stream/xstream/commit/8542d02d9ac5d384c85f4b33d6c1888c53bd55d3","https://github.com/x-stream/xstream/commit/e8e88621ba1c85ac3b8620337dd672e0c0c3a846"],"basis":"shared function","functions":["XStream","unmarshal"]}]}],"packageHistory":[{"cve":"CVE-2016-3674","published":"2016-05-17","fixed":"1.4.9","kev":false,"link":{"from":"CVE-2016-3674","to":"CVE-2017-7957","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:com.thoughtworks.xstream:xstream","fromFixed":"1.4.9","toFixed":"1.4.10","daysApart":347}]}},{"cve":"CVE-2017-7957","published":"2017-04-29","fixed":"1.4.10","kev":false},{"cve":"CVE-2013-7285","published":"2019-05-15","fixed":"1.4.11","kev":false},{"cve":"CVE-2019-10173","published":"2019-07-23","fixed":"1.4.11","kev":false},{"cve":"CVE-2020-26217","published":"2020-11-16","fixed":"1.4.14-java7","kev":false}],"package":"Maven:com.thoughtworks.xstream:xstream"}}