CVE-2021-29505
High
Description
XStream is software for serializing Java objects to XML and back again. A vulnerability in XStream versions prior to 1.4.17 may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types is affected. The vulnerability is patched in version 1.4.17.
SeverityHigh
CVSS7.5
Exploit probability—
Product
Xstream
PublishedMay 28, 2021
First seenMay 28, 2021
How to fix
Update
- xstream xstream1.4.17 or later
- com.thoughtworks.xstream:xstream1.4.17 or later
Vendor advisories
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/
- debian.org/security/2021/dsa-5004
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| xstream xstream | v < 1.4.17 | 1.4.17 |
| debian debian_linux | 9.0, 10.0, 11.0 | — |
| fedoraproject fedora | 33, 34, 35 | — |
| netapp snapmanager | No range specified | — |
| oracle banking_cash_management | 14.2, 14.3, 14.5 | — |
| oracle banking_corporate_lending_process_management | 14.2.0, 14.3.0, 14.5.0 | — |
| oracle banking_credit_facilities_process_management | 14.2.0, 14.3.0, 14.5.0 | — |
| oracle banking_supply_chain_finance | 14.2.0 | — |
| oracle banking_trade_finance_process_management | 14.5.0 | — |
| oracle business_activity_monitoring | 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0 | — |
| oracle communications_brm_-_elastic_charging_engine | 11.3, 12.0 | — |
| oracle communications_unified_inventory_management | 7.3.4, 7.3.5, 7.4.0, 7.4.1, 7.4.2 | — |
| oracle enterprise_manager_ops_center | 12.4.0.0 | — |
| oracle retail_customer_insights | 15.0.2, 16.0.2 | — |
| oracle retail_xstore_point_of_service | 16.0.6, 17.0.4, 18.0.3, 19.0.2, 20.0.1 | — |
| oracle webcenter_portal | 12.2.1.3.0, 12.2.1.4.0 | — |
| oracle webcenter_sites | 12.2.1.3.0, 12.2.1.4.0 | — |
| com.thoughtworks.xstream:xstreamMaven | v < 1.4.17 | 1.4.17 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.