CVE:CVE-2020-26217
CNNVD:CNNVD-202011-1441
XStream是XStream（Xstream）团队的一个轻量级的、简单易用的开源Java类库，它主要用于将对象序列化成XML（JSON）或反序列化为对象。
XStream 1.4.14之前版本存在操作系统命令注入漏洞，该漏洞源于容易受到远程代码执行的攻击。攻击者可利用该漏洞仅通过操纵已处理的输入流来运行任意shell命令。只有依赖黑名单的用户才会受到影响。
solution:Upgrade xstream_project xstream to a higher version than 1.4.14,and avoid the version (,1.4.14); Upgrade debian debian_linux to a higher version than 9.0,10.0,and avoid the version 9.0,10.0; Upgrade netapp snapmanager to a higher version than *,-; Upgrade apache activemq to a higher version than 5.15.4,and avoid the version 5.15.4; Upgrade oracle banking_cash_management to a higher version than 14.2,14.3,14.5,and avoid the version 14.2,14.3,14.5; Upgrade oracle banking_corporate_lending_process_management to a higher version than 14.2,14.3,14.5,and avoid the version 14.2,14.3,14.5; Upgrade oracle banking_credit_facilities_process_management to a higher version than 14.2,14.3,14.5,and avoid the version 14.2,14.3,14.5; Upgrade oracle banking_platform to a higher version than 2.4.0,2.7.1,2.9.0,and avoid the version 2.4.0,2.7.1,2.9.0; Upgrade oracle banking_supply_chain_finance to a higher version than 14.2,14.3,14.5,and avoid the version 14.2,14.3,14.5; Upgrade oracle banking_trade_finance_process_management to a higher version than 14.2,14.3,14.5,and avoid the version 14.2,14.3,14.5; Upgrade oracle banking_virtual_account_management to a higher version than 14.2.0,14.3.0,14.5.0,and avoid the version 14.2.0,14.3.0,14.5.0; Upgrade oracle business_activity_monitoring to a higher version than 11.1.1.9.0,12.2.1.3.0,12.2.1.4.0,and avoid the version 11.1.1.9.0,12.2.1.3.0,12.2.1.4.0; Upgrade oracle communications_policy_management to a higher version than 12.5.0,and avoid the version 12.5.0; Upgrade oracle endeca_information_discovery_studio to a higher version than 3.2.0.0,and avoid the version 3.2.0.0; Upgrade oracle retail_xstore_point_of_service to a higher version than 16.0.6,17.0.4,18.0.3,19.0.2,and avoid the version 16.0.6,17.0.4,18.0.3,19.0.2