CVE-2019-10173: It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserializat

This week

CRITICAL 9.8REMOTEDOWNGRADEUPGRADEDOWNGRADE

CVE-2019-10173 is a critical-severity flaw (CVSS 9.8) affecting xstream, banking platform, business activity monitoring. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw. If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when unmarshalling XML or any supported format. e.g. JSON. (regression of CVE-2013-7285)

Why this priority

Critical severity
EPSS top 1%: very likely to be exploited
Remotely exploitable, no login, no user action

A fixed release or distro patch exists.

Risk facts

CVSS score	9.8 (Critical)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	None
User interaction	None
EPSS exploit chance	95.0% (top 1%)
CISA exploited list	No
Weakness	CWE-94, CWE-502
Published	2019-07-23
Last modified	2026-06-17

Publisher (CNA): Red Hat, Inc. · Vendor: oracle · xstream

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2019-07-23 13:15 UTCPublished CVE record published
2026-06-17 02:10 UTCUpdated Record last modified

xstream xstream DOWNGRADE

Affected: 1.4.10

Fixed in: no fixed release known

Safe to downgrade to: a release before 1.4.10

1. Check installed version

apt-cache policy xstream || rpm -q xstream || xstream --version

2. No fixed release: DOWNGRADE to a release before 1.4.10 (Debian / Ubuntu)

apt-cache madison xstream sudo apt install xstream=<VERSION_BEFORE_1.4.10> sudo apt-mark hold xstream

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list xstream sudo dnf downgrade xstream-<VERSION_BEFORE_1.4.10> sudo dnf versionlock add xstream

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

oracle banking platform UPGRADE

Affected: >= 2.4.0 and <= 2.10.0 · 2.4.0 · 2.7.1 · 2.9.0

Fixed in: newer than 2.10.0

Safe to downgrade to: a release before 2.4.0

1. Check installed version

apt-cache policy banking-platform || rpm -q banking-platform || banking-platform --version

2. UPGRADE to newer than 2.10.0 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade banking-platform

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade banking-platform

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

3. If no update is available yet, DOWNGRADE to a release before 2.4.0 (Debian / Ubuntu)

apt-cache madison banking-platform sudo apt install banking-platform=<VERSION_BEFORE_2.4.0> sudo apt-mark hold banking-platform

3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list banking-platform sudo dnf downgrade banking-platform-<VERSION_BEFORE_2.4.0> sudo dnf versionlock add banking-platform

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

oracle business activity monitoring DOWNGRADE

Affected: 11.1.1.9.0 · 12.2.1.3.0 · 12.2.1.4.0

Fixed in: no fixed release known

Safe to downgrade to: a release before 11.1.1.9.0

1. Check installed version

apt-cache policy business-activity-monitoring || rpm -q business-activity-monitoring || business-activity-monitoring --version

2. No fixed release: DOWNGRADE to a release before 11.1.1.9.0 (Debian / Ubuntu)

apt-cache madison business-activity-monitoring sudo apt install business-activity-monitoring=<VERSION_BEFORE_11.1.1.9.0> sudo apt-mark hold business-activity-monitoring

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list business-activity-monitoring sudo dnf downgrade business-activity-monitoring-<VERSION_BEFORE_11.1.1.9.0> sudo dnf versionlock add business-activity-monitoring

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

oracle communications billing and revenue management elastic charging engine DOWNGRADE

Affected: 11.3.0.9.0 · 12.0.0.3.0

Fixed in: no fixed release known

Safe to downgrade to: a release before 11.3.0.9.0

1. Check installed version

apt-cache policy communications-billing-and-revenue-management-elastic-charging-engine || rpm -q communications-billing-and-revenue-management-elastic-charging-engine || communications-billing-and-revenue-management-elastic-charging-engine --version

2. No fixed release: DOWNGRADE to a release before 11.3.0.9.0 (Debian / Ubuntu)

apt-cache madison communications-billing-and-revenue-management-elastic-charging-engine sudo apt install communications-billing-and-revenue-management-elastic-charging-engine=<VERSION_BEFORE_11.3.0.9.0> sudo apt-mark hold communications-billing-and-revenue-management-elastic-charging-engine

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list communications-billing-and-revenue-management-elastic-charging-engine sudo dnf downgrade communications-billing-and-revenue-management-elastic-charging-engine-<VERSION_BEFORE_11.3.0.9.0> sudo dnf versionlock add communications-billing-and-revenue-management-elastic-charging-engine

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

oracle communications diameter signaling router UPGRADE

Affected: >= 8.0.0 and <= 8.2.2

Fixed in: newer than 8.2.2

Safe to downgrade to: a release before 8.0.0

1. Check installed version

apt-cache policy communications-diameter-signaling-router || rpm -q communications-diameter-signaling-router || communications-diameter-signaling-router --version

2. UPGRADE to newer than 8.2.2 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade communications-diameter-signaling-router

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade communications-diameter-signaling-router

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

3. If no update is available yet, DOWNGRADE to a release before 8.0.0 (Debian / Ubuntu)

apt-cache madison communications-diameter-signaling-router sudo apt install communications-diameter-signaling-router=<VERSION_BEFORE_8.0.0> sudo apt-mark hold communications-diameter-signaling-router

3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list communications-diameter-signaling-router sudo dnf downgrade communications-diameter-signaling-router-<VERSION_BEFORE_8.0.0> sudo dnf versionlock add communications-diameter-signaling-router

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

oracle communications unified inventory management DOWNGRADE

Affected: 7.3.0 · 7.4.0

Fixed in: no fixed release known

Safe to downgrade to: a release before 7.3.0

1. Check installed version

apt-cache policy communications-unified-inventory-management || rpm -q communications-unified-inventory-management || communications-unified-inventory-management --version

2. No fixed release: DOWNGRADE to a release before 7.3.0 (Debian / Ubuntu)

apt-cache madison communications-unified-inventory-management sudo apt install communications-unified-inventory-management=<VERSION_BEFORE_7.3.0> sudo apt-mark hold communications-unified-inventory-management

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list communications-unified-inventory-management sudo dnf downgrade communications-unified-inventory-management-<VERSION_BEFORE_7.3.0> sudo dnf versionlock add communications-unified-inventory-management

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2019-10173?

xstream: downgrade or apply the listed mitigation; banking platform: upgrade to newer than 2.10.0; business activity monitoring: downgrade or apply the listed mitigation. Exact commands for each OS are on this page.

Is CVE-2019-10173 being exploited?

CVE-2019-10173 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2019-10173 affect?

CVE-2019-10173 affects xstream, banking platform, business activity monitoring. Severity is critical (CVSS 9.8). It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw. If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when

How urgent is CVE-2019-10173?

Priority 64/100. Critical severity; EPSS top 1%: very likely to be exploited; Remotely exploitable, no login, no user action

Related CVEs

CVE-2013-7285 CRITICAL 9.8 DOWNGRADE DOWNGRADE Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may a
CVE-2021-39153 HIGH 8.5 UPGRADE MITIGATE XStream is a simple library to serialize objects to XML and back again
CVE-2021-39152 HIGH 8.5 UPGRADE MITIGATE XStream is a simple library to serialize objects to XML and back again
CVE-2021-39151 HIGH 8.5 UPGRADE MITIGATE XStream is a simple library to serialize objects to XML and back again
CVE-2021-39150 HIGH 8.5 UPGRADE MITIGATE XStream is a simple library to serialize objects to XML and back again

References

← Back to latest CVEs