CVE-2021-39149
High
Description
XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.
SeverityHigh
CVSS8.5
Exploit probability—
Product
Xstream
PublishedAug 23, 2021
First seenAug 23, 2021
How to fix
Update
- xstream xstream1.4.18 or later
- com.thoughtworks.xstream:xstream1.4.18 or later
Vendor advisories
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/
- debian.org/security/2021/dsa-5004
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| xstream xstream | v < 1.4.18 | 1.4.18 |
| fedoraproject fedora | 33, 34, 35 | — |
| debian debian_linux | 9.0, 10.0, 11.0 | — |
| netapp snapmanager | No range specified | — |
| oracle business_activity_monitoring | 12.2.1.4.0 | — |
| oracle commerce_guided_search | 11.3.2 | — |
| oracle communications_billing_and_revenue_management_elastic_charging_engine | 11.3, 12.0 | — |
| oracle communications_cloud_native_core_automated_test_suite | 1.9.0 | — |
| oracle communications_cloud_native_core_binding_support_function | 1.10.0 | — |
| oracle communications_cloud_native_core_policy | 1.14.0 | — |
| oracle communications_unified_inventory_management | 7.3.4, 7.3.5, 7.4.0, 7.4.1, 7.4.2 | — |
| oracle retail_xstore_point_of_service | 16.0.6, 17.0.4, 18.0.3, 19.0.2, 20.0.1 | — |
| oracle utilities_framework | 4.2.0.2.0, 4.2.0.3.0, 4.3.0.1.0, 4.3.0.6.0, 4.4.0.0.0, 4.4.0.2.0, 4.4.0.3.0 | — |
| oracle utilities_testing_accelerator | 6.0.0.1.1 | — |
| oracle webcenter_portal | 12.2.1.3.0, 12.2.1.4.0 | — |
| com.thoughtworks.xstream:xstreamMaven | v < 1.4.18 | 1.4.18 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.