[java-sig-commits] [Bug 1898944] CVE-2020-26217 xstream: remote code execution due to insecure XML deserialization when relying on blocklists [fedora-all]