csaf_opensuse - opensuse-su-2024:10592-1

Vulnerability from csaf_opensuse

Published

2024-06-15 00:00

Modified

2024-06-15 00:00

Summary

xstream-1.4.18-1.1 on GA media

Notes

Title of the patch

xstream-1.4.18-1.1 on GA media

Description of the patch

These are all security issues fixed in the xstream-1.4.18-1.1 package on the GA media of openSUSE Tumbleweed.

Patchnames

openSUSE-Tumbleweed-2024-10592

CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).

JSON

To clipboard

{
   document: {
      aggregate_severity: {
         namespace: "https://www.suse.com/support/security/rating/",
         text: "moderate",
      },
      category: "csaf_security_advisory",
      csaf_version: "2.0",
      distribution: {
         text: "Copyright 2024 SUSE LLC. All rights reserved.",
         tlp: {
            label: "WHITE",
            url: "https://www.first.org/tlp/",
         },
      },
      lang: "en",
      notes: [
         {
            category: "summary",
            text: "xstream-1.4.18-1.1 on GA media",
            title: "Title of the patch",
         },
         {
            category: "description",
            text: "These are all security issues fixed in the xstream-1.4.18-1.1 package on the GA media of openSUSE Tumbleweed.",
            title: "Description of the patch",
         },
         {
            category: "details",
            text: "openSUSE-Tumbleweed-2024-10592",
            title: "Patchnames",
         },
         {
            category: "legal_disclaimer",
            text: "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
            title: "Terms of use",
         },
      ],
      publisher: {
         category: "vendor",
         contact_details: "https://www.suse.com/support/security/contact/",
         name: "SUSE Product Security Team",
         namespace: "https://www.suse.com/",
      },
      references: [
         {
            category: "external",
            summary: "SUSE ratings",
            url: "https://www.suse.com/support/security/rating/",
         },
         {
            category: "self",
            summary: "URL of this CSAF notice",
            url: "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_10592-1.json",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2016-3674 page",
            url: "https://www.suse.com/security/cve/CVE-2016-3674/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2017-7957 page",
            url: "https://www.suse.com/security/cve/CVE-2017-7957/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2020-26217 page",
            url: "https://www.suse.com/security/cve/CVE-2020-26217/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2020-26258 page",
            url: "https://www.suse.com/security/cve/CVE-2020-26258/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2020-26259 page",
            url: "https://www.suse.com/security/cve/CVE-2020-26259/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2021-21341 page",
            url: "https://www.suse.com/security/cve/CVE-2021-21341/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2021-21342 page",
            url: "https://www.suse.com/security/cve/CVE-2021-21342/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2021-21343 page",
            url: "https://www.suse.com/security/cve/CVE-2021-21343/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2021-21344 page",
            url: "https://www.suse.com/security/cve/CVE-2021-21344/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2021-21345 page",
            url: "https://www.suse.com/security/cve/CVE-2021-21345/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2021-21346 page",
            url: "https://www.suse.com/security/cve/CVE-2021-21346/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2021-21347 page",
            url: "https://www.suse.com/security/cve/CVE-2021-21347/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2021-21348 page",
            url: "https://www.suse.com/security/cve/CVE-2021-21348/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2021-21349 page",
            url: "https://www.suse.com/security/cve/CVE-2021-21349/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2021-21350 page",
            url: "https://www.suse.com/security/cve/CVE-2021-21350/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2021-21351 page",
            url: "https://www.suse.com/security/cve/CVE-2021-21351/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2021-29505 page",
            url: "https://www.suse.com/security/cve/CVE-2021-29505/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2021-39139 page",
            url: "https://www.suse.com/security/cve/CVE-2021-39139/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2021-39144 page",
            url: "https://www.suse.com/security/cve/CVE-2021-39144/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2021-39147 page",
            url: "https://www.suse.com/security/cve/CVE-2021-39147/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2021-39150 page",
            url: "https://www.suse.com/security/cve/CVE-2021-39150/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2021-39153 page",
            url: "https://www.suse.com/security/cve/CVE-2021-39153/",
         },
      ],
      title: "xstream-1.4.18-1.1 on GA media",
      tracking: {
         current_release_date: "2024-06-15T00:00:00Z",
         generator: {
            date: "2024-06-15T00:00:00Z",
            engine: {
               name: "cve-database.git:bin/generate-csaf.pl",
               version: "1",
            },
         },
         id: "openSUSE-SU-2024:10592-1",
         initial_release_date: "2024-06-15T00:00:00Z",
         revision_history: [
            {
               date: "2024-06-15T00:00:00Z",
               number: "1",
               summary: "Current version",
            },
         ],
         status: "final",
         version: "1",
      },
   },
   product_tree: {
      branches: [
         {
            branches: [
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "xstream-1.4.18-1.1.aarch64",
                        product: {
                           name: "xstream-1.4.18-1.1.aarch64",
                           product_id: "xstream-1.4.18-1.1.aarch64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "xstream-benchmark-1.4.18-1.1.aarch64",
                        product: {
                           name: "xstream-benchmark-1.4.18-1.1.aarch64",
                           product_id: "xstream-benchmark-1.4.18-1.1.aarch64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "xstream-javadoc-1.4.18-1.1.aarch64",
                        product: {
                           name: "xstream-javadoc-1.4.18-1.1.aarch64",
                           product_id: "xstream-javadoc-1.4.18-1.1.aarch64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "xstream-parent-1.4.18-1.1.aarch64",
                        product: {
                           name: "xstream-parent-1.4.18-1.1.aarch64",
                           product_id: "xstream-parent-1.4.18-1.1.aarch64",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "aarch64",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "xstream-1.4.18-1.1.ppc64le",
                        product: {
                           name: "xstream-1.4.18-1.1.ppc64le",
                           product_id: "xstream-1.4.18-1.1.ppc64le",
                        },
                     },
                     {
                        category: "product_version",
                        name: "xstream-benchmark-1.4.18-1.1.ppc64le",
                        product: {
                           name: "xstream-benchmark-1.4.18-1.1.ppc64le",
                           product_id: "xstream-benchmark-1.4.18-1.1.ppc64le",
                        },
                     },
                     {
                        category: "product_version",
                        name: "xstream-javadoc-1.4.18-1.1.ppc64le",
                        product: {
                           name: "xstream-javadoc-1.4.18-1.1.ppc64le",
                           product_id: "xstream-javadoc-1.4.18-1.1.ppc64le",
                        },
                     },
                     {
                        category: "product_version",
                        name: "xstream-parent-1.4.18-1.1.ppc64le",
                        product: {
                           name: "xstream-parent-1.4.18-1.1.ppc64le",
                           product_id: "xstream-parent-1.4.18-1.1.ppc64le",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "ppc64le",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "xstream-1.4.18-1.1.s390x",
                        product: {
                           name: "xstream-1.4.18-1.1.s390x",
                           product_id: "xstream-1.4.18-1.1.s390x",
                        },
                     },
                     {
                        category: "product_version",
                        name: "xstream-benchmark-1.4.18-1.1.s390x",
                        product: {
                           name: "xstream-benchmark-1.4.18-1.1.s390x",
                           product_id: "xstream-benchmark-1.4.18-1.1.s390x",
                        },
                     },
                     {
                        category: "product_version",
                        name: "xstream-javadoc-1.4.18-1.1.s390x",
                        product: {
                           name: "xstream-javadoc-1.4.18-1.1.s390x",
                           product_id: "xstream-javadoc-1.4.18-1.1.s390x",
                        },
                     },
                     {
                        category: "product_version",
                        name: "xstream-parent-1.4.18-1.1.s390x",
                        product: {
                           name: "xstream-parent-1.4.18-1.1.s390x",
                           product_id: "xstream-parent-1.4.18-1.1.s390x",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "s390x",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "xstream-1.4.18-1.1.x86_64",
                        product: {
                           name: "xstream-1.4.18-1.1.x86_64",
                           product_id: "xstream-1.4.18-1.1.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "xstream-benchmark-1.4.18-1.1.x86_64",
                        product: {
                           name: "xstream-benchmark-1.4.18-1.1.x86_64",
                           product_id: "xstream-benchmark-1.4.18-1.1.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "xstream-javadoc-1.4.18-1.1.x86_64",
                        product: {
                           name: "xstream-javadoc-1.4.18-1.1.x86_64",
                           product_id: "xstream-javadoc-1.4.18-1.1.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "xstream-parent-1.4.18-1.1.x86_64",
                        product: {
                           name: "xstream-parent-1.4.18-1.1.x86_64",
                           product_id: "xstream-parent-1.4.18-1.1.x86_64",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "x86_64",
               },
               {
                  branches: [
                     {
                        category: "product_name",
                        name: "openSUSE Tumbleweed",
                        product: {
                           name: "openSUSE Tumbleweed",
                           product_id: "openSUSE Tumbleweed",
                           product_identification_helper: {
                              cpe: "cpe:/o:opensuse:tumbleweed",
                           },
                        },
                     },
                  ],
                  category: "product_family",
                  name: "SUSE Linux Enterprise",
               },
            ],
            category: "vendor",
            name: "SUSE",
         },
      ],
      relationships: [
         {
            category: "default_component_of",
            full_product_name: {
               name: "xstream-1.4.18-1.1.aarch64 as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
            },
            product_reference: "xstream-1.4.18-1.1.aarch64",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "xstream-1.4.18-1.1.ppc64le as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
            },
            product_reference: "xstream-1.4.18-1.1.ppc64le",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "xstream-1.4.18-1.1.s390x as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
            },
            product_reference: "xstream-1.4.18-1.1.s390x",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "xstream-1.4.18-1.1.x86_64 as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
            },
            product_reference: "xstream-1.4.18-1.1.x86_64",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "xstream-benchmark-1.4.18-1.1.aarch64 as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
            },
            product_reference: "xstream-benchmark-1.4.18-1.1.aarch64",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "xstream-benchmark-1.4.18-1.1.ppc64le as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
            },
            product_reference: "xstream-benchmark-1.4.18-1.1.ppc64le",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "xstream-benchmark-1.4.18-1.1.s390x as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
            },
            product_reference: "xstream-benchmark-1.4.18-1.1.s390x",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "xstream-benchmark-1.4.18-1.1.x86_64 as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
            },
            product_reference: "xstream-benchmark-1.4.18-1.1.x86_64",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "xstream-javadoc-1.4.18-1.1.aarch64 as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
            },
            product_reference: "xstream-javadoc-1.4.18-1.1.aarch64",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "xstream-javadoc-1.4.18-1.1.ppc64le as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
            },
            product_reference: "xstream-javadoc-1.4.18-1.1.ppc64le",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "xstream-javadoc-1.4.18-1.1.s390x as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
            },
            product_reference: "xstream-javadoc-1.4.18-1.1.s390x",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "xstream-javadoc-1.4.18-1.1.x86_64 as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
            },
            product_reference: "xstream-javadoc-1.4.18-1.1.x86_64",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "xstream-parent-1.4.18-1.1.aarch64 as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
            },
            product_reference: "xstream-parent-1.4.18-1.1.aarch64",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "xstream-parent-1.4.18-1.1.ppc64le as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
            },
            product_reference: "xstream-parent-1.4.18-1.1.ppc64le",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "xstream-parent-1.4.18-1.1.s390x as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
            },
            product_reference: "xstream-parent-1.4.18-1.1.s390x",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "xstream-parent-1.4.18-1.1.x86_64 as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64",
            },
            product_reference: "xstream-parent-1.4.18-1.1.x86_64",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
      ],
   },
   vulnerabilities: [
      {
         cve: "CVE-2016-3674",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2016-3674",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Multiple XML external entity (XXE) vulnerabilities in the (1) Dom4JDriver, (2) DomDriver, (3) JDomDriver, (4) JDom2Driver, (5) SjsxpDriver, (6) StandardStaxDriver, and (7) WstxDriver drivers in XStream before 1.4.9 allow remote attackers to read arbitrary files via a crafted XML document.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
               "openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
               "openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
               "openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
               "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
               "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
               "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
               "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
               "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
               "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
               "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
               "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
               "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
               "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
               "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
               "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2016-3674",
               url: "https://www.suse.com/security/cve/CVE-2016-3674",
            },
            {
               category: "external",
               summary: "SUSE Bug 972950 for CVE-2016-3674",
               url: "https://bugzilla.suse.com/972950",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
                  version: "3.0",
               },
               products: [
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-06-15T00:00:00Z",
               details: "important",
            },
         ],
         title: "CVE-2016-3674",
      },
      {
         cve: "CVE-2017-7957",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2017-7957",
            },
         ],
         notes: [
            {
               category: "general",
               text: "XStream through 1.4.9, when a certain denyTypes workaround is not used, mishandles attempts to create an instance of the primitive type 'void' during unmarshalling, leading to a remote application crash, as demonstrated by an xstream.fromXML(\"<void/>\") call.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
               "openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
               "openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
               "openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
               "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
               "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
               "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
               "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
               "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
               "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
               "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
               "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
               "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
               "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
               "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
               "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2017-7957",
               url: "https://www.suse.com/security/cve/CVE-2017-7957",
            },
            {
               category: "external",
               summary: "SUSE Bug 1070731 for CVE-2017-7957",
               url: "https://bugzilla.suse.com/1070731",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.0",
               },
               products: [
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-06-15T00:00:00Z",
               details: "important",
            },
         ],
         title: "CVE-2017-7957",
      },
      {
         cve: "CVE-2020-26217",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2020-26217",
            },
         ],
         notes: [
            {
               category: "general",
               text: "XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream. Only users who rely on blocklists are affected. Anyone using XStream's Security Framework allowlist is not affected. The linked advisory provides code workarounds for users who cannot upgrade. The issue is fixed in version 1.4.14.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
               "openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
               "openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
               "openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
               "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
               "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
               "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
               "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
               "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
               "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
               "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
               "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
               "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
               "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
               "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
               "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2020-26217",
               url: "https://www.suse.com/security/cve/CVE-2020-26217",
            },
            {
               category: "external",
               summary: "SUSE Bug 1180994 for CVE-2020-26217",
               url: "https://bugzilla.suse.com/1180994",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 8.1,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-06-15T00:00:00Z",
               details: "important",
            },
         ],
         title: "CVE-2020-26217",
      },
      {
         cve: "CVE-2020-26258",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2020-26258",
            },
         ],
         notes: [
            {
               category: "general",
               text: "XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, a Server-Side Forgery Request vulnerability can be activated when unmarshalling. The vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.15. The reported vulnerability does not exist if running Java 15 or higher. No user is affected who followed the recommendation to setup XStream's Security Framework with a whitelist! Anyone relying on XStream's default blacklist can immediately switch to a whilelist for the allowed types to avoid the vulnerability. Users of XStream 1.4.14 or below who still want to use XStream default blacklist can use a workaround described in more detailed in the referenced advisories.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
               "openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
               "openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
               "openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
               "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
               "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
               "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
               "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
               "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
               "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
               "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
               "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
               "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
               "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
               "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
               "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2020-26258",
               url: "https://www.suse.com/security/cve/CVE-2020-26258",
            },
            {
               category: "external",
               summary: "SUSE Bug 1180146 for CVE-2020-26258",
               url: "https://bugzilla.suse.com/1180146",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 4.3,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
                  version: "3.1",
               },
               products: [
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-06-15T00:00:00Z",
               details: "moderate",
            },
         ],
         title: "CVE-2020-26258",
      },
      {
         cve: "CVE-2020-26259",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2020-26259",
            },
         ],
         notes: [
            {
               category: "general",
               text: "XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling. The vulnerability may allow a remote attacker to delete arbitrary know files on the host as log as the executing process has sufficient rights only by manipulating the processed input stream. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.15. The reported vulnerability does not exist running Java 15 or higher. No user is affected, who followed the recommendation to setup XStream's Security Framework with a whitelist! Anyone relying on XStream's default blacklist can immediately switch to a whilelist for the allowed types to avoid the vulnerability. Users of XStream 1.4.14 or below who still want to use XStream default blacklist can use a workaround described in more detailed in the referenced advisories.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
               "openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
               "openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
               "openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
               "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
               "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
               "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
               "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
               "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
               "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
               "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
               "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
               "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
               "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
               "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
               "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2020-26259",
               url: "https://www.suse.com/security/cve/CVE-2020-26259",
            },
            {
               category: "external",
               summary: "SUSE Bug 1180145 for CVE-2020-26259",
               url: "https://bugzilla.suse.com/1180145",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 5.4,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
                  version: "3.1",
               },
               products: [
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-06-15T00:00:00Z",
               details: "moderate",
            },
         ],
         title: "CVE-2020-26259",
      },
      {
         cve: "CVE-2021-21341",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2021-21341",
            },
         ],
         notes: [
            {
               category: "general",
               text: "XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is vulnerability which may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a payload resulting in a denial of service only by manipulating the processed input stream. No user is affected who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
               "openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
               "openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
               "openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
               "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
               "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
               "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
               "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
               "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
               "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
               "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
               "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
               "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
               "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
               "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
               "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2021-21341",
               url: "https://www.suse.com/security/cve/CVE-2021-21341",
            },
            {
               category: "external",
               summary: "SUSE Bug 1184377 for CVE-2021-21341",
               url: "https://bugzilla.suse.com/1184377",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 5.9,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-06-15T00:00:00Z",
               details: "moderate",
            },
         ],
         title: "CVE-2021-21341",
      },
      {
         cve: "CVE-2021-21342",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2021-21342",
            },
         ],
         notes: [
            {
               category: "general",
               text: "XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability where the processed stream at unmarshalling time contains type information to recreate the formerly written objects. XStream creates therefore new instances based on these type information. An attacker can manipulate the processed input stream and replace or inject objects, that result in a server-side forgery request. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
               "openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
               "openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
               "openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
               "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
               "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
               "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
               "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
               "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
               "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
               "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
               "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
               "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
               "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
               "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
               "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2021-21342",
               url: "https://www.suse.com/security/cve/CVE-2021-21342",
            },
            {
               category: "external",
               summary: "SUSE Bug 1184379 for CVE-2021-21342",
               url: "https://bugzilla.suse.com/1184379",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7.4,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
                  version: "3.1",
               },
               products: [
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-06-15T00:00:00Z",
               details: "important",
            },
         ],
         title: "CVE-2021-21342",
      },
      {
         cve: "CVE-2021-21343",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2021-21343",
            },
         ],
         notes: [
            {
               category: "general",
               text: "XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability where the processed stream at unmarshalling time contains type information to recreate the formerly written objects. XStream creates therefore new instances based on these type information. An attacker can manipulate the processed input stream and replace or inject objects, that result in the deletion of a file on the local host. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
               "openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
               "openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
               "openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
               "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
               "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
               "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
               "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
               "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
               "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
               "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
               "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
               "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
               "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
               "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
               "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2021-21343",
               url: "https://www.suse.com/security/cve/CVE-2021-21343",
            },
            {
               category: "external",
               summary: "SUSE Bug 1184376 for CVE-2021-21343",
               url: "https://bugzilla.suse.com/1184376",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 5.9,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
                  version: "3.1",
               },
               products: [
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-06-15T00:00:00Z",
               details: "moderate",
            },
         ],
         title: "CVE-2021-21343",
      },
      {
         cve: "CVE-2021-21344",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2021-21344",
            },
         ],
         notes: [
            {
               category: "general",
               text: "XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
               "openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
               "openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
               "openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
               "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
               "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
               "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
               "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
               "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
               "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
               "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
               "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
               "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
               "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
               "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
               "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2021-21344",
               url: "https://www.suse.com/security/cve/CVE-2021-21344",
            },
            {
               category: "external",
               summary: "SUSE Bug 1184375 for CVE-2021-21344",
               url: "https://bugzilla.suse.com/1184375",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7.3,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
                  version: "3.1",
               },
               products: [
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-06-15T00:00:00Z",
               details: "important",
            },
         ],
         title: "CVE-2021-21344",
      },
      {
         cve: "CVE-2021-21345",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2021-21345",
            },
         ],
         notes: [
            {
               category: "general",
               text: "XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker who has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
               "openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
               "openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
               "openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
               "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
               "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
               "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
               "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
               "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
               "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
               "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
               "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
               "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
               "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
               "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
               "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2021-21345",
               url: "https://www.suse.com/security/cve/CVE-2021-21345",
            },
            {
               category: "external",
               summary: "SUSE Bug 1184372 for CVE-2021-21345",
               url: "https://bugzilla.suse.com/1184372",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 8.5,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-06-15T00:00:00Z",
               details: "important",
            },
         ],
         title: "CVE-2021-21345",
      },
      {
         cve: "CVE-2021-21346",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2021-21346",
            },
         ],
         notes: [
            {
               category: "general",
               text: "XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
               "openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
               "openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
               "openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
               "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
               "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
               "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
               "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
               "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
               "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
               "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
               "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
               "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
               "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
               "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
               "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2021-21346",
               url: "https://www.suse.com/security/cve/CVE-2021-21346",
            },
            {
               category: "external",
               summary: "SUSE Bug 1184373 for CVE-2021-21346",
               url: "https://bugzilla.suse.com/1184373",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 8.1,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-06-15T00:00:00Z",
               details: "important",
            },
         ],
         title: "CVE-2021-21346",
      },
      {
         cve: "CVE-2021-21347",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2021-21347",
            },
         ],
         notes: [
            {
               category: "general",
               text: "XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
               "openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
               "openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
               "openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
               "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
               "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
               "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
               "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
               "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
               "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
               "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
               "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
               "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
               "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
               "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
               "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2021-21347",
               url: "https://www.suse.com/security/cve/CVE-2021-21347",
            },
            {
               category: "external",
               summary: "SUSE Bug 1184378 for CVE-2021-21347",
               url: "https://bugzilla.suse.com/1184378",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 8.1,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-06-15T00:00:00Z",
               details: "important",
            },
         ],
         title: "CVE-2021-21347",
      },
      {
         cve: "CVE-2021-21348",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2021-21348",
            },
         ],
         notes: [
            {
               category: "general",
               text: "XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to occupy a thread that consumes maximum CPU time and will never return. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
               "openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
               "openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
               "openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
               "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
               "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
               "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
               "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
               "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
               "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
               "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
               "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
               "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
               "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
               "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
               "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2021-21348",
               url: "https://www.suse.com/security/cve/CVE-2021-21348",
            },
            {
               category: "external",
               summary: "SUSE Bug 1184374 for CVE-2021-21348",
               url: "https://bugzilla.suse.com/1184374",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 5.9,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-06-15T00:00:00Z",
               details: "moderate",
            },
         ],
         title: "CVE-2021-21348",
      },
      {
         cve: "CVE-2021-21349",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2021-21349",
            },
         ],
         notes: [
            {
               category: "general",
               text: "XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
               "openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
               "openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
               "openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
               "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
               "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
               "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
               "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
               "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
               "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
               "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
               "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
               "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
               "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
               "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
               "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2021-21349",
               url: "https://www.suse.com/security/cve/CVE-2021-21349",
            },
            {
               category: "external",
               summary: "SUSE Bug 1184797 for CVE-2021-21349",
               url: "https://bugzilla.suse.com/1184797",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 5.9,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
                  version: "3.1",
               },
               products: [
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-06-15T00:00:00Z",
               details: "moderate",
            },
         ],
         title: "CVE-2021-21349",
      },
      {
         cve: "CVE-2021-21350",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2021-21350",
            },
         ],
         notes: [
            {
               category: "general",
               text: "XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to execute arbitrary code only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
               "openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
               "openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
               "openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
               "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
               "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
               "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
               "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
               "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
               "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
               "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
               "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
               "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
               "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
               "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
               "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2021-21350",
               url: "https://www.suse.com/security/cve/CVE-2021-21350",
            },
            {
               category: "external",
               summary: "SUSE Bug 1184380 for CVE-2021-21350",
               url: "https://bugzilla.suse.com/1184380",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 8.1,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-06-15T00:00:00Z",
               details: "important",
            },
         ],
         title: "CVE-2021-21350",
      },
      {
         cve: "CVE-2021-21351",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2021-21351",
            },
         ],
         notes: [
            {
               category: "general",
               text: "XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
               "openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
               "openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
               "openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
               "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
               "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
               "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
               "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
               "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
               "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
               "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
               "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
               "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
               "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
               "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
               "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2021-21351",
               url: "https://www.suse.com/security/cve/CVE-2021-21351",
            },
            {
               category: "external",
               summary: "SUSE Bug 1184796 for CVE-2021-21351",
               url: "https://bugzilla.suse.com/1184796",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 8,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-06-15T00:00:00Z",
               details: "important",
            },
         ],
         title: "CVE-2021-21351",
      },
      {
         cve: "CVE-2021-29505",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2021-29505",
            },
         ],
         notes: [
            {
               category: "general",
               text: "XStream is software for serializing Java objects to XML and back again. A vulnerability in XStream versions prior to 1.4.17 may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types is affected. The vulnerability is patched in version 1.4.17.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
               "openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
               "openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
               "openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
               "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
               "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
               "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
               "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
               "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
               "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
               "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
               "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
               "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
               "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
               "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
               "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2021-29505",
               url: "https://www.suse.com/security/cve/CVE-2021-29505",
            },
            {
               category: "external",
               summary: "SUSE Bug 1186651 for CVE-2021-29505",
               url: "https://bugzilla.suse.com/1186651",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 8.1,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-06-15T00:00:00Z",
               details: "important",
            },
         ],
         title: "CVE-2021-29505",
      },
      {
         cve: "CVE-2021-39139",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2021-39139",
            },
         ],
         notes: [
            {
               category: "general",
               text: "XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. A user is only affected if using the version out of the box with JDK 1.7u21 or below. However, this scenario can be adjusted easily to an external Xalan that works regardless of the version of the Java runtime. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
               "openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
               "openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
               "openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
               "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
               "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
               "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
               "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
               "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
               "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
               "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
               "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
               "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
               "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
               "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
               "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2021-39139",
               url: "https://www.suse.com/security/cve/CVE-2021-39139",
            },
            {
               category: "external",
               summary: "SUSE Bug 1189798 for CVE-2021-39139",
               url: "https://bugzilla.suse.com/1189798",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 8.1,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-06-15T00:00:00Z",
               details: "important",
            },
         ],
         title: "CVE-2021-39139",
      },
      {
         cve: "CVE-2021-39144",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2021-39144",
            },
         ],
         notes: [
            {
               category: "general",
               text: "XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
               "openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
               "openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
               "openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
               "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
               "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
               "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
               "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
               "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
               "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
               "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
               "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
               "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
               "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
               "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
               "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2021-39144",
               url: "https://www.suse.com/security/cve/CVE-2021-39144",
            },
            {
               category: "external",
               summary: "SUSE Bug 1189798 for CVE-2021-39144",
               url: "https://bugzilla.suse.com/1189798",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 8.1,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-06-15T00:00:00Z",
               details: "important",
            },
         ],
         title: "CVE-2021-39144",
      },
      {
         cve: "CVE-2021-39147",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2021-39147",
            },
         ],
         notes: [
            {
               category: "general",
               text: "XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
               "openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
               "openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
               "openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
               "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
               "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
               "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
               "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
               "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
               "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
               "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
               "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
               "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
               "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
               "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
               "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2021-39147",
               url: "https://www.suse.com/security/cve/CVE-2021-39147",
            },
            {
               category: "external",
               summary: "SUSE Bug 1189798 for CVE-2021-39147",
               url: "https://bugzilla.suse.com/1189798",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 8.1,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-06-15T00:00:00Z",
               details: "important",
            },
         ],
         title: "CVE-2021-39147",
      },
      {
         cve: "CVE-2021-39150",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2021-39150",
            },
         ],
         notes: [
            {
               category: "general",
               text: "XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream with a Java runtime version 14 to 8. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the [Security Framework](https://x-stream.github.io/security.html#framework), you will have to use at least version 1.4.18.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
               "openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
               "openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
               "openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
               "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
               "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
               "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
               "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
               "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
               "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
               "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
               "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
               "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
               "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
               "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
               "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2021-39150",
               url: "https://www.suse.com/security/cve/CVE-2021-39150",
            },
            {
               category: "external",
               summary: "SUSE Bug 1189798 for CVE-2021-39150",
               url: "https://bugzilla.suse.com/1189798",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 5.3,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
                  version: "3.1",
               },
               products: [
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-06-15T00:00:00Z",
               details: "important",
            },
         ],
         title: "CVE-2021-39150",
      },
      {
         cve: "CVE-2021-39153",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2021-39153",
            },
         ],
         notes: [
            {
               category: "general",
               text: "XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream, if using the version out of the box with Java runtime version 14 to 8 or with JavaFX installed. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
               "openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
               "openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
               "openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
               "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
               "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
               "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
               "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
               "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
               "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
               "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
               "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
               "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
               "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
               "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
               "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2021-39153",
               url: "https://www.suse.com/security/cve/CVE-2021-39153",
            },
            {
               category: "external",
               summary: "SUSE Bug 1189798 for CVE-2021-39153",
               url: "https://bugzilla.suse.com/1189798",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 8.1,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-benchmark-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-javadoc-1.4.18-1.1.x86_64",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.aarch64",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.ppc64le",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.s390x",
                  "openSUSE Tumbleweed:xstream-parent-1.4.18-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-06-15T00:00:00Z",
               details: "important",
            },
         ],
         title: "CVE-2021-39153",
      },
   ],
}

cve-2021-39144

Vulnerability from cvelistv5

Published

2021-08-23 00:00

Modified

2025-02-06 19:44

Severity ?

8.5 (High) - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Summary

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.

References

▼	URL	Tags
	https://github.com/x-stream/xstream/security/advisories/GHSA-j9h8-phrw-h4fh
	https://x-stream.github.io/CVE-2021-39144.html
	https://lists.debian.org/debian-lts-announce/2021/09/msg00017.html	mailing-list
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/	vendor-advisory
	https://www.debian.org/security/2021/dsa-5004	vendor-advisory
	https://www.oracle.com/security-alerts/cpujan2022.html
	https://security.netapp.com/advisory/ntap-20210923-0003/
	https://www.oracle.com/security-alerts/cpuapr2022.html
	https://www.oracle.com/security-alerts/cpujul2022.html
	http://packetstormsecurity.com/files/169859/VMware-NSX-Manager-XStream-Unauthenticated-Remote-Code-Execution.html

Impacted products

	Vendor	Product	Version
	x-stream	xstream	Version: < 1.4.18

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T01:58:18.167Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/x-stream/xstream/security/advisories/GHSA-j9h8-phrw-h4fh",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://x-stream.github.io/CVE-2021-39144.html",
               },
               {
                  name: "[debian-lts-announce] 20210929 [SECURITY] [DLA 2769-1] libxstream-java security update",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2021/09/msg00017.html",
               },
               {
                  name: "FEDORA-2021-fbad11014a",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/",
               },
               {
                  name: "FEDORA-2021-d894ca87dc",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/",
               },
               {
                  name: "FEDORA-2021-5e376c0ed9",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/",
               },
               {
                  name: "DSA-5004",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://www.debian.org/security/2021/dsa-5004",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpujan2022.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20210923-0003/",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpuapr2022.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpujul2022.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://packetstormsecurity.com/files/169859/VMware-NSX-Manager-XStream-Unauthenticated-Remote-Code-Execution.html",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2021-39144",
                        options: [
                           {
                              Exploitation: "active",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-02-06T19:37:39.138340Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
               {
                  other: {
                     content: {
                        dateAdded: "2023-03-10",
                        reference: "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-39144",
                     },
                     type: "kev",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-02-06T19:44:09.888Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "xstream",
               vendor: "x-stream",
               versions: [
                  {
                     status: "affected",
                     version: "< 1.4.18 ",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 8.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "LOW",
                  scope: "CHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-94",
                     description: "CWE-94: Improper Control of Generation of Code ('Code Injection')",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
            {
               descriptions: [
                  {
                     cweId: "CWE-502",
                     description: "CWE-502: Deserialization of Untrusted Data",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-11-15T00:00:00.000Z",
            orgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
            shortName: "GitHub_M",
         },
         references: [
            {
               url: "https://github.com/x-stream/xstream/security/advisories/GHSA-j9h8-phrw-h4fh",
            },
            {
               url: "https://x-stream.github.io/CVE-2021-39144.html",
            },
            {
               name: "[debian-lts-announce] 20210929 [SECURITY] [DLA 2769-1] libxstream-java security update",
               tags: [
                  "mailing-list",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2021/09/msg00017.html",
            },
            {
               name: "FEDORA-2021-fbad11014a",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/",
            },
            {
               name: "FEDORA-2021-d894ca87dc",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/",
            },
            {
               name: "FEDORA-2021-5e376c0ed9",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/",
            },
            {
               name: "DSA-5004",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://www.debian.org/security/2021/dsa-5004",
            },
            {
               url: "https://www.oracle.com/security-alerts/cpujan2022.html",
            },
            {
               url: "https://security.netapp.com/advisory/ntap-20210923-0003/",
            },
            {
               url: "https://www.oracle.com/security-alerts/cpuapr2022.html",
            },
            {
               url: "https://www.oracle.com/security-alerts/cpujul2022.html",
            },
            {
               url: "http://packetstormsecurity.com/files/169859/VMware-NSX-Manager-XStream-Unauthenticated-Remote-Code-Execution.html",
            },
         ],
         source: {
            advisory: "GHSA-j9h8-phrw-h4fh",
            discovery: "UNKNOWN",
         },
         title: "XStream is vulnerable to a Remote Command Execution attack",
      },
   },
   cveMetadata: {
      assignerOrgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
      assignerShortName: "GitHub_M",
      cveId: "CVE-2021-39144",
      datePublished: "2021-08-23T00:00:00.000Z",
      dateReserved: "2021-08-16T00:00:00.000Z",
      dateUpdated: "2025-02-06T19:44:09.888Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2021-39139

Vulnerability from cvelistv5

Published

2021-08-23 17:50

Modified

2024-08-04 01:58

Severity ?

8.5 (High) - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Summary

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. A user is only affected if using the version out of the box with JDK 1.7u21 or below. However, this scenario can be adjusted easily to an external Xalan that works regardless of the version of the Java runtime. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.

References

▼	URL	Tags
	https://github.com/x-stream/xstream/security/advisories/GHSA-64xx-cq4q-mf44	x_refsource_CONFIRM
	https://x-stream.github.io/CVE-2021-39139.html	x_refsource_MISC
	https://lists.debian.org/debian-lts-announce/2021/09/msg00017.html	mailing-list, x_refsource_MLIST
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/	vendor-advisory, x_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/	vendor-advisory, x_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/	vendor-advisory, x_refsource_FEDORA
	https://www.debian.org/security/2021/dsa-5004	vendor-advisory, x_refsource_DEBIAN
	https://www.oracle.com/security-alerts/cpujan2022.html	x_refsource_MISC
	https://security.netapp.com/advisory/ntap-20210923-0003/	x_refsource_CONFIRM
	https://www.oracle.com/security-alerts/cpuapr2022.html	x_refsource_MISC
	https://www.oracle.com/security-alerts/cpujul2022.html	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	x-stream	xstream	Version: < 1.4.18

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T01:58:18.173Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://github.com/x-stream/xstream/security/advisories/GHSA-64xx-cq4q-mf44",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://x-stream.github.io/CVE-2021-39139.html",
               },
               {
                  name: "[debian-lts-announce] 20210929 [SECURITY] [DLA 2769-1] libxstream-java security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2021/09/msg00017.html",
               },
               {
                  name: "FEDORA-2021-fbad11014a",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/",
               },
               {
                  name: "FEDORA-2021-d894ca87dc",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/",
               },
               {
                  name: "FEDORA-2021-5e376c0ed9",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/",
               },
               {
                  name: "DSA-5004",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_DEBIAN",
                     "x_transferred",
                  ],
                  url: "https://www.debian.org/security/2021/dsa-5004",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpujan2022.html",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20210923-0003/",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpuapr2022.html",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpujul2022.html",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "xstream",
               vendor: "x-stream",
               versions: [
                  {
                     status: "affected",
                     version: "< 1.4.18",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. A user is only affected if using the version out of the box with JDK 1.7u21 or below. However, this scenario can be adjusted easily to an external Xalan that works regardless of the version of the Java runtime. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 8.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "LOW",
                  scope: "CHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-502",
                     description: "CWE-502: Deserialization of Untrusted Data",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
            {
               descriptions: [
                  {
                     cweId: "CWE-434",
                     description: "CWE-434: Unrestricted Upload of File with Dangerous Type",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-07-25T16:32:08",
            orgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
            shortName: "GitHub_M",
         },
         references: [
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://github.com/x-stream/xstream/security/advisories/GHSA-64xx-cq4q-mf44",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://x-stream.github.io/CVE-2021-39139.html",
            },
            {
               name: "[debian-lts-announce] 20210929 [SECURITY] [DLA 2769-1] libxstream-java security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2021/09/msg00017.html",
            },
            {
               name: "FEDORA-2021-fbad11014a",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/",
            },
            {
               name: "FEDORA-2021-d894ca87dc",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/",
            },
            {
               name: "FEDORA-2021-5e376c0ed9",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/",
            },
            {
               name: "DSA-5004",
               tags: [
                  "vendor-advisory",
                  "x_refsource_DEBIAN",
               ],
               url: "https://www.debian.org/security/2021/dsa-5004",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com/security-alerts/cpujan2022.html",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://security.netapp.com/advisory/ntap-20210923-0003/",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com/security-alerts/cpuapr2022.html",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com/security-alerts/cpujul2022.html",
            },
         ],
         source: {
            advisory: "GHSA-64xx-cq4q-mf44",
            discovery: "UNKNOWN",
         },
         title: "XStream is vulnerable to an Arbitrary Code Execution attack",
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "security-advisories@github.com",
               ID: "CVE-2021-39139",
               STATE: "PUBLIC",
               TITLE: "XStream is vulnerable to an Arbitrary Code Execution attack",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "xstream",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "< 1.4.18",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "x-stream",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. A user is only affected if using the version out of the box with JDK 1.7u21 or below. However, this scenario can be adjusted easily to an external Xalan that works regardless of the version of the Java runtime. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.",
                  },
               ],
            },
            impact: {
               cvss: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 8.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "LOW",
                  scope: "CHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
                  version: "3.1",
               },
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-502: Deserialization of Untrusted Data",
                        },
                     ],
                  },
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-434: Unrestricted Upload of File with Dangerous Type",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://github.com/x-stream/xstream/security/advisories/GHSA-64xx-cq4q-mf44",
                     refsource: "CONFIRM",
                     url: "https://github.com/x-stream/xstream/security/advisories/GHSA-64xx-cq4q-mf44",
                  },
                  {
                     name: "https://x-stream.github.io/CVE-2021-39139.html",
                     refsource: "MISC",
                     url: "https://x-stream.github.io/CVE-2021-39139.html",
                  },
                  {
                     name: "[debian-lts-announce] 20210929 [SECURITY] [DLA 2769-1] libxstream-java security update",
                     refsource: "MLIST",
                     url: "https://lists.debian.org/debian-lts-announce/2021/09/msg00017.html",
                  },
                  {
                     name: "FEDORA-2021-fbad11014a",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/",
                  },
                  {
                     name: "FEDORA-2021-d894ca87dc",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/",
                  },
                  {
                     name: "FEDORA-2021-5e376c0ed9",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/",
                  },
                  {
                     name: "DSA-5004",
                     refsource: "DEBIAN",
                     url: "https://www.debian.org/security/2021/dsa-5004",
                  },
                  {
                     name: "https://www.oracle.com/security-alerts/cpujan2022.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com/security-alerts/cpujan2022.html",
                  },
                  {
                     name: "https://security.netapp.com/advisory/ntap-20210923-0003/",
                     refsource: "CONFIRM",
                     url: "https://security.netapp.com/advisory/ntap-20210923-0003/",
                  },
                  {
                     name: "https://www.oracle.com/security-alerts/cpuapr2022.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com/security-alerts/cpuapr2022.html",
                  },
                  {
                     name: "https://www.oracle.com/security-alerts/cpujul2022.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com/security-alerts/cpujul2022.html",
                  },
               ],
            },
            source: {
               advisory: "GHSA-64xx-cq4q-mf44",
               discovery: "UNKNOWN",
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
      assignerShortName: "GitHub_M",
      cveId: "CVE-2021-39139",
      datePublished: "2021-08-23T17:50:14",
      dateReserved: "2021-08-16T00:00:00",
      dateUpdated: "2024-08-04T01:58:18.173Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2021-39150

Vulnerability from cvelistv5

Published

2021-08-23 18:20

Modified

2024-08-04 01:58

Severity ?

8.5 (High) - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Summary

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream with a Java runtime version 14 to 8. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the [Security Framework](https://x-stream.github.io/security.html#framework), you will have to use at least version 1.4.18.

References

▼	URL	Tags
	https://github.com/x-stream/xstream/security/advisories/GHSA-cxfm-5m4g-x7xp	x_refsource_CONFIRM
	https://x-stream.github.io/CVE-2021-39150.html	x_refsource_MISC
	https://lists.debian.org/debian-lts-announce/2021/09/msg00017.html	mailing-list, x_refsource_MLIST
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/	vendor-advisory, x_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/	vendor-advisory, x_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/	vendor-advisory, x_refsource_FEDORA
	https://www.debian.org/security/2021/dsa-5004	vendor-advisory, x_refsource_DEBIAN
	https://www.oracle.com/security-alerts/cpujan2022.html	x_refsource_MISC
	https://security.netapp.com/advisory/ntap-20210923-0003/	x_refsource_CONFIRM
	https://www.oracle.com/security-alerts/cpuapr2022.html	x_refsource_MISC
	https://www.oracle.com/security-alerts/cpujul2022.html	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	x-stream	xstream	Version: < 1.4.18

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T01:58:18.258Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://github.com/x-stream/xstream/security/advisories/GHSA-cxfm-5m4g-x7xp",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://x-stream.github.io/CVE-2021-39150.html",
               },
               {
                  name: "[debian-lts-announce] 20210929 [SECURITY] [DLA 2769-1] libxstream-java security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2021/09/msg00017.html",
               },
               {
                  name: "FEDORA-2021-fbad11014a",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/",
               },
               {
                  name: "FEDORA-2021-d894ca87dc",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/",
               },
               {
                  name: "FEDORA-2021-5e376c0ed9",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/",
               },
               {
                  name: "DSA-5004",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_DEBIAN",
                     "x_transferred",
                  ],
                  url: "https://www.debian.org/security/2021/dsa-5004",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpujan2022.html",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20210923-0003/",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpuapr2022.html",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpujul2022.html",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "xstream",
               vendor: "x-stream",
               versions: [
                  {
                     status: "affected",
                     version: "< 1.4.18",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream with a Java runtime version 14 to 8. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the [Security Framework](https://x-stream.github.io/security.html#framework), you will have to use at least version 1.4.18.",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 8.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "LOW",
                  scope: "CHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-502",
                     description: "CWE-502: Deserialization of Untrusted Data",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
            {
               descriptions: [
                  {
                     cweId: "CWE-918",
                     description: "CWE-918: Server-Side Request Forgery (SSRF)",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-07-25T16:33:47",
            orgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
            shortName: "GitHub_M",
         },
         references: [
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://github.com/x-stream/xstream/security/advisories/GHSA-cxfm-5m4g-x7xp",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://x-stream.github.io/CVE-2021-39150.html",
            },
            {
               name: "[debian-lts-announce] 20210929 [SECURITY] [DLA 2769-1] libxstream-java security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2021/09/msg00017.html",
            },
            {
               name: "FEDORA-2021-fbad11014a",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/",
            },
            {
               name: "FEDORA-2021-d894ca87dc",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/",
            },
            {
               name: "FEDORA-2021-5e376c0ed9",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/",
            },
            {
               name: "DSA-5004",
               tags: [
                  "vendor-advisory",
                  "x_refsource_DEBIAN",
               ],
               url: "https://www.debian.org/security/2021/dsa-5004",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com/security-alerts/cpujan2022.html",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://security.netapp.com/advisory/ntap-20210923-0003/",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com/security-alerts/cpuapr2022.html",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com/security-alerts/cpujul2022.html",
            },
         ],
         source: {
            advisory: "GHSA-cxfm-5m4g-x7xp",
            discovery: "UNKNOWN",
         },
         title: "A Server-Side Forgery Request vulnerability in XStream via PriorityQueue unmarshaling",
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "security-advisories@github.com",
               ID: "CVE-2021-39150",
               STATE: "PUBLIC",
               TITLE: "A Server-Side Forgery Request vulnerability in XStream via PriorityQueue unmarshaling",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "xstream",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "< 1.4.18",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "x-stream",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream with a Java runtime version 14 to 8. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the [Security Framework](https://x-stream.github.io/security.html#framework), you will have to use at least version 1.4.18.",
                  },
               ],
            },
            impact: {
               cvss: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 8.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "LOW",
                  scope: "CHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
                  version: "3.1",
               },
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-502: Deserialization of Untrusted Data",
                        },
                     ],
                  },
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-918: Server-Side Request Forgery (SSRF)",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://github.com/x-stream/xstream/security/advisories/GHSA-cxfm-5m4g-x7xp",
                     refsource: "CONFIRM",
                     url: "https://github.com/x-stream/xstream/security/advisories/GHSA-cxfm-5m4g-x7xp",
                  },
                  {
                     name: "https://x-stream.github.io/CVE-2021-39150.html",
                     refsource: "MISC",
                     url: "https://x-stream.github.io/CVE-2021-39150.html",
                  },
                  {
                     name: "[debian-lts-announce] 20210929 [SECURITY] [DLA 2769-1] libxstream-java security update",
                     refsource: "MLIST",
                     url: "https://lists.debian.org/debian-lts-announce/2021/09/msg00017.html",
                  },
                  {
                     name: "FEDORA-2021-fbad11014a",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/",
                  },
                  {
                     name: "FEDORA-2021-d894ca87dc",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/",
                  },
                  {
                     name: "FEDORA-2021-5e376c0ed9",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/",
                  },
                  {
                     name: "DSA-5004",
                     refsource: "DEBIAN",
                     url: "https://www.debian.org/security/2021/dsa-5004",
                  },
                  {
                     name: "https://www.oracle.com/security-alerts/cpujan2022.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com/security-alerts/cpujan2022.html",
                  },
                  {
                     name: "https://security.netapp.com/advisory/ntap-20210923-0003/",
                     refsource: "CONFIRM",
                     url: "https://security.netapp.com/advisory/ntap-20210923-0003/",
                  },
                  {
                     name: "https://www.oracle.com/security-alerts/cpuapr2022.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com/security-alerts/cpuapr2022.html",
                  },
                  {
                     name: "https://www.oracle.com/security-alerts/cpujul2022.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com/security-alerts/cpujul2022.html",
                  },
               ],
            },
            source: {
               advisory: "GHSA-cxfm-5m4g-x7xp",
               discovery: "UNKNOWN",
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
      assignerShortName: "GitHub_M",
      cveId: "CVE-2021-39150",
      datePublished: "2021-08-23T18:20:15",
      dateReserved: "2021-08-16T00:00:00",
      dateUpdated: "2024-08-04T01:58:18.258Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2021-21350

Vulnerability from cvelistv5

Published

2021-03-22 23:45

Modified

2024-08-03 18:09

Severity ?

5.3 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N

Summary

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to execute arbitrary code only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.

References

▼	URL	Tags
	https://x-stream.github.io/security.html#workaround	x_refsource_MISC
	http://x-stream.github.io/changes.html#1.4.16	x_refsource_MISC
	https://github.com/x-stream/xstream/security/advisories/GHSA-43gc-mjxg-gvrq	x_refsource_CONFIRM
	https://x-stream.github.io/CVE-2021-21350.html	x_refsource_MISC
	https://lists.debian.org/debian-lts-announce/2021/04/msg00002.html	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fac48b425c6e16b0%40%3Cdev.jmeter.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae655414d23ed0dd%40%3Cusers.activemq.apache.org%3E	mailing-list, x_refsource_MLIST
	https://security.netapp.com/advisory/ntap-20210430-0002/	x_refsource_CONFIRM
	https://www.oracle.com//security-alerts/cpujul2021.html	x_refsource_MISC
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/	vendor-advisory, x_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/	vendor-advisory, x_refsource_FEDORA
	https://www.oracle.com/security-alerts/cpuoct2021.html	x_refsource_MISC
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/	vendor-advisory, x_refsource_FEDORA
	https://www.debian.org/security/2021/dsa-5004	vendor-advisory, x_refsource_DEBIAN
	https://www.oracle.com/security-alerts/cpujan2022.html	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	x-stream	xstream	Version: < 1.4.16

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T18:09:15.914Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://x-stream.github.io/security.html#workaround",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "http://x-stream.github.io/changes.html#1.4.16",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://github.com/x-stream/xstream/security/advisories/GHSA-43gc-mjxg-gvrq",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://x-stream.github.io/CVE-2021-21350.html",
               },
               {
                  name: "[debian-lts-announce] 20210403 [SECURITY] [DLA 2616-1] libxstream-java security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2021/04/msg00002.html",
               },
               {
                  name: "[jmeter-dev] 20210406 [GitHub] [jmeter] sseide opened a new pull request #655: update x-stream to 1.4.16 (from 1.4.15)",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fac48b425c6e16b0%40%3Cdev.jmeter.apache.org%3E",
               },
               {
                  name: "[activemq-users] 20210427 Release date for ActiveMQ v5.16.2 to fix CVEs",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae655414d23ed0dd%40%3Cusers.activemq.apache.org%3E",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20210430-0002/",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com//security-alerts/cpujul2021.html",
               },
               {
                  name: "FEDORA-2021-fbad11014a",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/",
               },
               {
                  name: "FEDORA-2021-d894ca87dc",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpuoct2021.html",
               },
               {
                  name: "FEDORA-2021-5e376c0ed9",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/",
               },
               {
                  name: "DSA-5004",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_DEBIAN",
                     "x_transferred",
                  ],
                  url: "https://www.debian.org/security/2021/dsa-5004",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpujan2022.html",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "xstream",
               vendor: "x-stream",
               versions: [
                  {
                     status: "affected",
                     version: "< 1.4.16",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to execute arbitrary code only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 5.3,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "NONE",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-434",
                     description: "CWE-434 Unrestricted Upload of File with Dangerous Type",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
            {
               descriptions: [
                  {
                     cweId: "CWE-502",
                     description: "CWE-502 Deserialization of Untrusted Data",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-02-07T14:41:22",
            orgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
            shortName: "GitHub_M",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://x-stream.github.io/security.html#workaround",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "http://x-stream.github.io/changes.html#1.4.16",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://github.com/x-stream/xstream/security/advisories/GHSA-43gc-mjxg-gvrq",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://x-stream.github.io/CVE-2021-21350.html",
            },
            {
               name: "[debian-lts-announce] 20210403 [SECURITY] [DLA 2616-1] libxstream-java security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2021/04/msg00002.html",
            },
            {
               name: "[jmeter-dev] 20210406 [GitHub] [jmeter] sseide opened a new pull request #655: update x-stream to 1.4.16 (from 1.4.15)",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fac48b425c6e16b0%40%3Cdev.jmeter.apache.org%3E",
            },
            {
               name: "[activemq-users] 20210427 Release date for ActiveMQ v5.16.2 to fix CVEs",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae655414d23ed0dd%40%3Cusers.activemq.apache.org%3E",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://security.netapp.com/advisory/ntap-20210430-0002/",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com//security-alerts/cpujul2021.html",
            },
            {
               name: "FEDORA-2021-fbad11014a",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/",
            },
            {
               name: "FEDORA-2021-d894ca87dc",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com/security-alerts/cpuoct2021.html",
            },
            {
               name: "FEDORA-2021-5e376c0ed9",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/",
            },
            {
               name: "DSA-5004",
               tags: [
                  "vendor-advisory",
                  "x_refsource_DEBIAN",
               ],
               url: "https://www.debian.org/security/2021/dsa-5004",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com/security-alerts/cpujan2022.html",
            },
         ],
         source: {
            advisory: "GHSA-43gc-mjxg-gvrq",
            discovery: "UNKNOWN",
         },
         title: "XStream is vulnerable to an Arbitrary Code Execution attack",
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "security-advisories@github.com",
               ID: "CVE-2021-21350",
               STATE: "PUBLIC",
               TITLE: "XStream is vulnerable to an Arbitrary Code Execution attack",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "xstream",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "< 1.4.16",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "x-stream",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to execute arbitrary code only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.",
                  },
               ],
            },
            impact: {
               cvss: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 5.3,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "NONE",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N",
                  version: "3.1",
               },
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-434 Unrestricted Upload of File with Dangerous Type",
                        },
                     ],
                  },
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-502 Deserialization of Untrusted Data",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://x-stream.github.io/security.html#workaround",
                     refsource: "MISC",
                     url: "https://x-stream.github.io/security.html#workaround",
                  },
                  {
                     name: "http://x-stream.github.io/changes.html#1.4.16",
                     refsource: "MISC",
                     url: "http://x-stream.github.io/changes.html#1.4.16",
                  },
                  {
                     name: "https://github.com/x-stream/xstream/security/advisories/GHSA-43gc-mjxg-gvrq",
                     refsource: "CONFIRM",
                     url: "https://github.com/x-stream/xstream/security/advisories/GHSA-43gc-mjxg-gvrq",
                  },
                  {
                     name: "https://x-stream.github.io/CVE-2021-21350.html",
                     refsource: "MISC",
                     url: "https://x-stream.github.io/CVE-2021-21350.html",
                  },
                  {
                     name: "[debian-lts-announce] 20210403 [SECURITY] [DLA 2616-1] libxstream-java security update",
                     refsource: "MLIST",
                     url: "https://lists.debian.org/debian-lts-announce/2021/04/msg00002.html",
                  },
                  {
                     name: "[jmeter-dev] 20210406 [GitHub] [jmeter] sseide opened a new pull request #655: update x-stream to 1.4.16 (from 1.4.15)",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fac48b425c6e16b0@%3Cdev.jmeter.apache.org%3E",
                  },
                  {
                     name: "[activemq-users] 20210427 Release date for ActiveMQ v5.16.2 to fix CVEs",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae655414d23ed0dd@%3Cusers.activemq.apache.org%3E",
                  },
                  {
                     name: "https://security.netapp.com/advisory/ntap-20210430-0002/",
                     refsource: "CONFIRM",
                     url: "https://security.netapp.com/advisory/ntap-20210430-0002/",
                  },
                  {
                     name: "https://www.oracle.com//security-alerts/cpujul2021.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com//security-alerts/cpujul2021.html",
                  },
                  {
                     name: "FEDORA-2021-fbad11014a",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/",
                  },
                  {
                     name: "FEDORA-2021-d894ca87dc",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/",
                  },
                  {
                     name: "https://www.oracle.com/security-alerts/cpuoct2021.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com/security-alerts/cpuoct2021.html",
                  },
                  {
                     name: "FEDORA-2021-5e376c0ed9",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/",
                  },
                  {
                     name: "DSA-5004",
                     refsource: "DEBIAN",
                     url: "https://www.debian.org/security/2021/dsa-5004",
                  },
                  {
                     name: "https://www.oracle.com/security-alerts/cpujan2022.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com/security-alerts/cpujan2022.html",
                  },
               ],
            },
            source: {
               advisory: "GHSA-43gc-mjxg-gvrq",
               discovery: "UNKNOWN",
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
      assignerShortName: "GitHub_M",
      cveId: "CVE-2021-21350",
      datePublished: "2021-03-22T23:45:20",
      dateReserved: "2020-12-22T00:00:00",
      dateUpdated: "2024-08-03T18:09:15.914Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2021-21345

Vulnerability from cvelistv5

Published

2021-03-22 23:40

Modified

2024-08-03 18:09

Severity ?

5.8 (Medium) - CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:N

Summary

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker who has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.

References

▼	URL	Tags
	https://x-stream.github.io/security.html#workaround	x_refsource_MISC
	http://x-stream.github.io/changes.html#1.4.16	x_refsource_MISC
	https://github.com/x-stream/xstream/security/advisories/GHSA-hwpc-8xqv-jvj4	x_refsource_CONFIRM
	https://x-stream.github.io/CVE-2021-21345.html	x_refsource_MISC
	https://lists.debian.org/debian-lts-announce/2021/04/msg00002.html	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fac48b425c6e16b0%40%3Cdev.jmeter.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae655414d23ed0dd%40%3Cusers.activemq.apache.org%3E	mailing-list, x_refsource_MLIST
	https://www.oracle.com/security-alerts/cpuApr2021.html	x_refsource_MISC
	https://security.netapp.com/advisory/ntap-20210430-0002/	x_refsource_CONFIRM
	https://www.oracle.com//security-alerts/cpujul2021.html	x_refsource_MISC
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/	vendor-advisory, x_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/	vendor-advisory, x_refsource_FEDORA
	https://www.oracle.com/security-alerts/cpuoct2021.html	x_refsource_MISC
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/	vendor-advisory, x_refsource_FEDORA
	https://www.debian.org/security/2021/dsa-5004	vendor-advisory, x_refsource_DEBIAN
	https://www.oracle.com/security-alerts/cpujan2022.html	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	x-stream	xstream	Version: < 1.4.16

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T18:09:15.855Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://x-stream.github.io/security.html#workaround",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "http://x-stream.github.io/changes.html#1.4.16",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://github.com/x-stream/xstream/security/advisories/GHSA-hwpc-8xqv-jvj4",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://x-stream.github.io/CVE-2021-21345.html",
               },
               {
                  name: "[debian-lts-announce] 20210403 [SECURITY] [DLA 2616-1] libxstream-java security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2021/04/msg00002.html",
               },
               {
                  name: "[jmeter-dev] 20210406 [GitHub] [jmeter] sseide opened a new pull request #655: update x-stream to 1.4.16 (from 1.4.15)",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fac48b425c6e16b0%40%3Cdev.jmeter.apache.org%3E",
               },
               {
                  name: "[activemq-users] 20210427 Release date for ActiveMQ v5.16.2 to fix CVEs",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae655414d23ed0dd%40%3Cusers.activemq.apache.org%3E",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpuApr2021.html",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20210430-0002/",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com//security-alerts/cpujul2021.html",
               },
               {
                  name: "FEDORA-2021-fbad11014a",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/",
               },
               {
                  name: "FEDORA-2021-d894ca87dc",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpuoct2021.html",
               },
               {
                  name: "FEDORA-2021-5e376c0ed9",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/",
               },
               {
                  name: "DSA-5004",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_DEBIAN",
                     "x_transferred",
                  ],
                  url: "https://www.debian.org/security/2021/dsa-5004",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpujan2022.html",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "xstream",
               vendor: "x-stream",
               versions: [
                  {
                     status: "affected",
                     version: "< 1.4.16",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker who has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 5.8,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "NONE",
                  integrityImpact: "HIGH",
                  privilegesRequired: "LOW",
                  scope: "CHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:N",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-94",
                     description: "CWE-94 Improper Control of Generation of Code ('Code Injection')",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
            {
               descriptions: [
                  {
                     cweId: "CWE-502",
                     description: "CWE-502 Deserialization of Untrusted Data",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-02-07T14:41:17",
            orgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
            shortName: "GitHub_M",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://x-stream.github.io/security.html#workaround",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "http://x-stream.github.io/changes.html#1.4.16",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://github.com/x-stream/xstream/security/advisories/GHSA-hwpc-8xqv-jvj4",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://x-stream.github.io/CVE-2021-21345.html",
            },
            {
               name: "[debian-lts-announce] 20210403 [SECURITY] [DLA 2616-1] libxstream-java security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2021/04/msg00002.html",
            },
            {
               name: "[jmeter-dev] 20210406 [GitHub] [jmeter] sseide opened a new pull request #655: update x-stream to 1.4.16 (from 1.4.15)",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fac48b425c6e16b0%40%3Cdev.jmeter.apache.org%3E",
            },
            {
               name: "[activemq-users] 20210427 Release date for ActiveMQ v5.16.2 to fix CVEs",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae655414d23ed0dd%40%3Cusers.activemq.apache.org%3E",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com/security-alerts/cpuApr2021.html",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://security.netapp.com/advisory/ntap-20210430-0002/",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com//security-alerts/cpujul2021.html",
            },
            {
               name: "FEDORA-2021-fbad11014a",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/",
            },
            {
               name: "FEDORA-2021-d894ca87dc",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com/security-alerts/cpuoct2021.html",
            },
            {
               name: "FEDORA-2021-5e376c0ed9",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/",
            },
            {
               name: "DSA-5004",
               tags: [
                  "vendor-advisory",
                  "x_refsource_DEBIAN",
               ],
               url: "https://www.debian.org/security/2021/dsa-5004",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com/security-alerts/cpujan2022.html",
            },
         ],
         source: {
            advisory: "GHSA-hwpc-8xqv-jvj4",
            discovery: "UNKNOWN",
         },
         title: "XStream is vulnerable to a Remote Command Execution attack",
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "security-advisories@github.com",
               ID: "CVE-2021-21345",
               STATE: "PUBLIC",
               TITLE: "XStream is vulnerable to a Remote Command Execution attack",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "xstream",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "< 1.4.16",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "x-stream",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker who has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.",
                  },
               ],
            },
            impact: {
               cvss: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 5.8,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "NONE",
                  integrityImpact: "HIGH",
                  privilegesRequired: "LOW",
                  scope: "CHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:N",
                  version: "3.1",
               },
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-94 Improper Control of Generation of Code ('Code Injection')",
                        },
                     ],
                  },
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-502 Deserialization of Untrusted Data",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://x-stream.github.io/security.html#workaround",
                     refsource: "MISC",
                     url: "https://x-stream.github.io/security.html#workaround",
                  },
                  {
                     name: "http://x-stream.github.io/changes.html#1.4.16",
                     refsource: "MISC",
                     url: "http://x-stream.github.io/changes.html#1.4.16",
                  },
                  {
                     name: "https://github.com/x-stream/xstream/security/advisories/GHSA-hwpc-8xqv-jvj4",
                     refsource: "CONFIRM",
                     url: "https://github.com/x-stream/xstream/security/advisories/GHSA-hwpc-8xqv-jvj4",
                  },
                  {
                     name: "https://x-stream.github.io/CVE-2021-21345.html",
                     refsource: "MISC",
                     url: "https://x-stream.github.io/CVE-2021-21345.html",
                  },
                  {
                     name: "[debian-lts-announce] 20210403 [SECURITY] [DLA 2616-1] libxstream-java security update",
                     refsource: "MLIST",
                     url: "https://lists.debian.org/debian-lts-announce/2021/04/msg00002.html",
                  },
                  {
                     name: "[jmeter-dev] 20210406 [GitHub] [jmeter] sseide opened a new pull request #655: update x-stream to 1.4.16 (from 1.4.15)",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fac48b425c6e16b0@%3Cdev.jmeter.apache.org%3E",
                  },
                  {
                     name: "[activemq-users] 20210427 Release date for ActiveMQ v5.16.2 to fix CVEs",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae655414d23ed0dd@%3Cusers.activemq.apache.org%3E",
                  },
                  {
                     name: "https://www.oracle.com/security-alerts/cpuApr2021.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com/security-alerts/cpuApr2021.html",
                  },
                  {
                     name: "https://security.netapp.com/advisory/ntap-20210430-0002/",
                     refsource: "CONFIRM",
                     url: "https://security.netapp.com/advisory/ntap-20210430-0002/",
                  },
                  {
                     name: "https://www.oracle.com//security-alerts/cpujul2021.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com//security-alerts/cpujul2021.html",
                  },
                  {
                     name: "FEDORA-2021-fbad11014a",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/",
                  },
                  {
                     name: "FEDORA-2021-d894ca87dc",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/",
                  },
                  {
                     name: "https://www.oracle.com/security-alerts/cpuoct2021.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com/security-alerts/cpuoct2021.html",
                  },
                  {
                     name: "FEDORA-2021-5e376c0ed9",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/",
                  },
                  {
                     name: "DSA-5004",
                     refsource: "DEBIAN",
                     url: "https://www.debian.org/security/2021/dsa-5004",
                  },
                  {
                     name: "https://www.oracle.com/security-alerts/cpujan2022.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com/security-alerts/cpujan2022.html",
                  },
               ],
            },
            source: {
               advisory: "GHSA-hwpc-8xqv-jvj4",
               discovery: "UNKNOWN",
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
      assignerShortName: "GitHub_M",
      cveId: "CVE-2021-21345",
      datePublished: "2021-03-22T23:40:25",
      dateReserved: "2020-12-22T00:00:00",
      dateUpdated: "2024-08-03T18:09:15.855Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2021-21347

Vulnerability from cvelistv5

Published

2021-03-22 23:40

Modified

2024-08-03 18:09

Severity ?

6.1 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N

Summary

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.

References

▼	URL	Tags
	https://github.com/x-stream/xstream/security/advisories/GHSA-qpfq-ph7r-qv6f	x_refsource_CONFIRM
	https://x-stream.github.io/security.html#workaround	x_refsource_MISC
	http://x-stream.github.io/changes.html#1.4.16	x_refsource_MISC
	https://x-stream.github.io/CVE-2021-21347.html	x_refsource_MISC
	https://lists.debian.org/debian-lts-announce/2021/04/msg00002.html	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fac48b425c6e16b0%40%3Cdev.jmeter.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae655414d23ed0dd%40%3Cusers.activemq.apache.org%3E	mailing-list, x_refsource_MLIST
	https://security.netapp.com/advisory/ntap-20210430-0002/	x_refsource_CONFIRM
	https://www.oracle.com//security-alerts/cpujul2021.html	x_refsource_MISC
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/	vendor-advisory, x_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/	vendor-advisory, x_refsource_FEDORA
	https://www.oracle.com/security-alerts/cpuoct2021.html	x_refsource_MISC
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/	vendor-advisory, x_refsource_FEDORA
	https://www.debian.org/security/2021/dsa-5004	vendor-advisory, x_refsource_DEBIAN
	https://www.oracle.com/security-alerts/cpujan2022.html	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	x-stream	xstream	Version: < 1.4.16

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T18:09:15.686Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://github.com/x-stream/xstream/security/advisories/GHSA-qpfq-ph7r-qv6f",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://x-stream.github.io/security.html#workaround",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "http://x-stream.github.io/changes.html#1.4.16",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://x-stream.github.io/CVE-2021-21347.html",
               },
               {
                  name: "[debian-lts-announce] 20210403 [SECURITY] [DLA 2616-1] libxstream-java security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2021/04/msg00002.html",
               },
               {
                  name: "[jmeter-dev] 20210406 [GitHub] [jmeter] sseide opened a new pull request #655: update x-stream to 1.4.16 (from 1.4.15)",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fac48b425c6e16b0%40%3Cdev.jmeter.apache.org%3E",
               },
               {
                  name: "[activemq-users] 20210427 Release date for ActiveMQ v5.16.2 to fix CVEs",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae655414d23ed0dd%40%3Cusers.activemq.apache.org%3E",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20210430-0002/",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com//security-alerts/cpujul2021.html",
               },
               {
                  name: "FEDORA-2021-fbad11014a",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/",
               },
               {
                  name: "FEDORA-2021-d894ca87dc",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpuoct2021.html",
               },
               {
                  name: "FEDORA-2021-5e376c0ed9",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/",
               },
               {
                  name: "DSA-5004",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_DEBIAN",
                     "x_transferred",
                  ],
                  url: "https://www.debian.org/security/2021/dsa-5004",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpujan2022.html",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "xstream",
               vendor: "x-stream",
               versions: [
                  {
                     status: "affected",
                     version: "< 1.4.16",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 6.1,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "NONE",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "CHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-434",
                     description: "CWE-434 Unrestricted Upload of File with Dangerous Type",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
            {
               descriptions: [
                  {
                     cweId: "CWE-502",
                     description: "CWE-502 Deserialization of Untrusted Data",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-02-07T14:41:19",
            orgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
            shortName: "GitHub_M",
         },
         references: [
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://github.com/x-stream/xstream/security/advisories/GHSA-qpfq-ph7r-qv6f",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://x-stream.github.io/security.html#workaround",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "http://x-stream.github.io/changes.html#1.4.16",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://x-stream.github.io/CVE-2021-21347.html",
            },
            {
               name: "[debian-lts-announce] 20210403 [SECURITY] [DLA 2616-1] libxstream-java security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2021/04/msg00002.html",
            },
            {
               name: "[jmeter-dev] 20210406 [GitHub] [jmeter] sseide opened a new pull request #655: update x-stream to 1.4.16 (from 1.4.15)",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fac48b425c6e16b0%40%3Cdev.jmeter.apache.org%3E",
            },
            {
               name: "[activemq-users] 20210427 Release date for ActiveMQ v5.16.2 to fix CVEs",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae655414d23ed0dd%40%3Cusers.activemq.apache.org%3E",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://security.netapp.com/advisory/ntap-20210430-0002/",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com//security-alerts/cpujul2021.html",
            },
            {
               name: "FEDORA-2021-fbad11014a",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/",
            },
            {
               name: "FEDORA-2021-d894ca87dc",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com/security-alerts/cpuoct2021.html",
            },
            {
               name: "FEDORA-2021-5e376c0ed9",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/",
            },
            {
               name: "DSA-5004",
               tags: [
                  "vendor-advisory",
                  "x_refsource_DEBIAN",
               ],
               url: "https://www.debian.org/security/2021/dsa-5004",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com/security-alerts/cpujan2022.html",
            },
         ],
         source: {
            advisory: "GHSA-qpfq-ph7r-qv6f",
            discovery: "UNKNOWN",
         },
         title: "XStream is vulnerable to an Arbitrary Code Execution attack",
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "security-advisories@github.com",
               ID: "CVE-2021-21347",
               STATE: "PUBLIC",
               TITLE: "XStream is vulnerable to an Arbitrary Code Execution attack",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "xstream",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "< 1.4.16",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "x-stream",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.",
                  },
               ],
            },
            impact: {
               cvss: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 6.1,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "NONE",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "CHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N",
                  version: "3.1",
               },
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-434 Unrestricted Upload of File with Dangerous Type",
                        },
                     ],
                  },
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-502 Deserialization of Untrusted Data",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://github.com/x-stream/xstream/security/advisories/GHSA-qpfq-ph7r-qv6f",
                     refsource: "CONFIRM",
                     url: "https://github.com/x-stream/xstream/security/advisories/GHSA-qpfq-ph7r-qv6f",
                  },
                  {
                     name: "https://x-stream.github.io/security.html#workaround",
                     refsource: "MISC",
                     url: "https://x-stream.github.io/security.html#workaround",
                  },
                  {
                     name: "http://x-stream.github.io/changes.html#1.4.16",
                     refsource: "MISC",
                     url: "http://x-stream.github.io/changes.html#1.4.16",
                  },
                  {
                     name: "https://x-stream.github.io/CVE-2021-21347.html",
                     refsource: "MISC",
                     url: "https://x-stream.github.io/CVE-2021-21347.html",
                  },
                  {
                     name: "[debian-lts-announce] 20210403 [SECURITY] [DLA 2616-1] libxstream-java security update",
                     refsource: "MLIST",
                     url: "https://lists.debian.org/debian-lts-announce/2021/04/msg00002.html",
                  },
                  {
                     name: "[jmeter-dev] 20210406 [GitHub] [jmeter] sseide opened a new pull request #655: update x-stream to 1.4.16 (from 1.4.15)",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fac48b425c6e16b0@%3Cdev.jmeter.apache.org%3E",
                  },
                  {
                     name: "[activemq-users] 20210427 Release date for ActiveMQ v5.16.2 to fix CVEs",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae655414d23ed0dd@%3Cusers.activemq.apache.org%3E",
                  },
                  {
                     name: "https://security.netapp.com/advisory/ntap-20210430-0002/",
                     refsource: "CONFIRM",
                     url: "https://security.netapp.com/advisory/ntap-20210430-0002/",
                  },
                  {
                     name: "https://www.oracle.com//security-alerts/cpujul2021.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com//security-alerts/cpujul2021.html",
                  },
                  {
                     name: "FEDORA-2021-fbad11014a",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/",
                  },
                  {
                     name: "FEDORA-2021-d894ca87dc",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/",
                  },
                  {
                     name: "https://www.oracle.com/security-alerts/cpuoct2021.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com/security-alerts/cpuoct2021.html",
                  },
                  {
                     name: "FEDORA-2021-5e376c0ed9",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/",
                  },
                  {
                     name: "DSA-5004",
                     refsource: "DEBIAN",
                     url: "https://www.debian.org/security/2021/dsa-5004",
                  },
                  {
                     name: "https://www.oracle.com/security-alerts/cpujan2022.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com/security-alerts/cpujan2022.html",
                  },
               ],
            },
            source: {
               advisory: "GHSA-qpfq-ph7r-qv6f",
               discovery: "UNKNOWN",
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
      assignerShortName: "GitHub_M",
      cveId: "CVE-2021-21347",
      datePublished: "2021-03-22T23:40:13",
      dateReserved: "2020-12-22T00:00:00",
      dateUpdated: "2024-08-03T18:09:15.686Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2021-29505

Vulnerability from cvelistv5

Published

2021-05-28 21:00

Modified

2024-08-03 22:11

Severity ?

7.5 (High) - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

XStream is software for serializing Java objects to XML and back again. A vulnerability in XStream versions prior to 1.4.17 may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types is affected. The vulnerability is patched in version 1.4.17.

References

▼	URL	Tags
	https://github.com/x-stream/xstream/security/advisories/GHSA-7chv-rrw6-w6fc	x_refsource_CONFIRM
	https://github.com/x-stream/xstream/commit/24fac82191292c6ae25f94508d28b9823f83624f	x_refsource_MISC
	https://lists.apache.org/thread.html/r8ee51debf7fd184b6a6b020dc31df25118b0aa612885f12fbe77f04f%40%3Cdev.jmeter.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.debian.org/debian-lts-announce/2021/07/msg00004.html	mailing-list, x_refsource_MLIST
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/	vendor-advisory, x_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/	vendor-advisory, x_refsource_FEDORA
	https://www.oracle.com/security-alerts/cpuoct2021.html	x_refsource_MISC
	https://security.netapp.com/advisory/ntap-20210708-0007/	x_refsource_CONFIRM
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/	vendor-advisory, x_refsource_FEDORA
	https://www.debian.org/security/2021/dsa-5004	vendor-advisory, x_refsource_DEBIAN
	https://www.oracle.com/security-alerts/cpujan2022.html	x_refsource_MISC
	https://www.oracle.com/security-alerts/cpuapr2022.html	x_refsource_MISC
	https://www.oracle.com/security-alerts/cpujul2022.html	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	x-stream	xstream	Version: < 1.4.17

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T22:11:05.321Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://github.com/x-stream/xstream/security/advisories/GHSA-7chv-rrw6-w6fc",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://github.com/x-stream/xstream/commit/24fac82191292c6ae25f94508d28b9823f83624f",
               },
               {
                  name: "[jmeter-dev] 20210607 [GitHub] [jmeter] sseide opened a new pull request #667: update x-stream to 1.4.17 (from 1.4.16)",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r8ee51debf7fd184b6a6b020dc31df25118b0aa612885f12fbe77f04f%40%3Cdev.jmeter.apache.org%3E",
               },
               {
                  name: "[debian-lts-announce] 20210705 [SECURITY] [DLA 2704-1] libxstream-java security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2021/07/msg00004.html",
               },
               {
                  name: "FEDORA-2021-fbad11014a",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/",
               },
               {
                  name: "FEDORA-2021-d894ca87dc",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpuoct2021.html",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20210708-0007/",
               },
               {
                  name: "FEDORA-2021-5e376c0ed9",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/",
               },
               {
                  name: "DSA-5004",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_DEBIAN",
                     "x_transferred",
                  ],
                  url: "https://www.debian.org/security/2021/dsa-5004",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpujan2022.html",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpuapr2022.html",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpujul2022.html",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "xstream",
               vendor: "x-stream",
               versions: [
                  {
                     status: "affected",
                     version: "< 1.4.17",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "XStream is software for serializing Java objects to XML and back again. A vulnerability in XStream versions prior to 1.4.17 may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types is affected. The vulnerability is patched in version 1.4.17.",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "LOW",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-94",
                     description: "CWE-94: Improper Control of Generation of Code ('Code Injection')",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
            {
               descriptions: [
                  {
                     cweId: "CWE-502",
                     description: "CWE-502: Deserialization of Untrusted Data",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-07-25T16:27:15",
            orgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
            shortName: "GitHub_M",
         },
         references: [
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://github.com/x-stream/xstream/security/advisories/GHSA-7chv-rrw6-w6fc",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/x-stream/xstream/commit/24fac82191292c6ae25f94508d28b9823f83624f",
            },
            {
               name: "[jmeter-dev] 20210607 [GitHub] [jmeter] sseide opened a new pull request #667: update x-stream to 1.4.17 (from 1.4.16)",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r8ee51debf7fd184b6a6b020dc31df25118b0aa612885f12fbe77f04f%40%3Cdev.jmeter.apache.org%3E",
            },
            {
               name: "[debian-lts-announce] 20210705 [SECURITY] [DLA 2704-1] libxstream-java security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2021/07/msg00004.html",
            },
            {
               name: "FEDORA-2021-fbad11014a",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/",
            },
            {
               name: "FEDORA-2021-d894ca87dc",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com/security-alerts/cpuoct2021.html",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://security.netapp.com/advisory/ntap-20210708-0007/",
            },
            {
               name: "FEDORA-2021-5e376c0ed9",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/",
            },
            {
               name: "DSA-5004",
               tags: [
                  "vendor-advisory",
                  "x_refsource_DEBIAN",
               ],
               url: "https://www.debian.org/security/2021/dsa-5004",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com/security-alerts/cpujan2022.html",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com/security-alerts/cpuapr2022.html",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com/security-alerts/cpujul2022.html",
            },
         ],
         source: {
            advisory: "GHSA-7chv-rrw6-w6fc",
            discovery: "UNKNOWN",
         },
         title: "XStream is vulnerable to a Remote Command Execution attack",
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "security-advisories@github.com",
               ID: "CVE-2021-29505",
               STATE: "PUBLIC",
               TITLE: "XStream is vulnerable to a Remote Command Execution attack",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "xstream",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "< 1.4.17",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "x-stream",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "XStream is software for serializing Java objects to XML and back again. A vulnerability in XStream versions prior to 1.4.17 may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types is affected. The vulnerability is patched in version 1.4.17.",
                  },
               ],
            },
            impact: {
               cvss: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "LOW",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-94: Improper Control of Generation of Code ('Code Injection')",
                        },
                     ],
                  },
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-502: Deserialization of Untrusted Data",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://github.com/x-stream/xstream/security/advisories/GHSA-7chv-rrw6-w6fc",
                     refsource: "CONFIRM",
                     url: "https://github.com/x-stream/xstream/security/advisories/GHSA-7chv-rrw6-w6fc",
                  },
                  {
                     name: "https://github.com/x-stream/xstream/commit/24fac82191292c6ae25f94508d28b9823f83624f",
                     refsource: "MISC",
                     url: "https://github.com/x-stream/xstream/commit/24fac82191292c6ae25f94508d28b9823f83624f",
                  },
                  {
                     name: "[jmeter-dev] 20210607 [GitHub] [jmeter] sseide opened a new pull request #667: update x-stream to 1.4.17 (from 1.4.16)",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r8ee51debf7fd184b6a6b020dc31df25118b0aa612885f12fbe77f04f@%3Cdev.jmeter.apache.org%3E",
                  },
                  {
                     name: "[debian-lts-announce] 20210705 [SECURITY] [DLA 2704-1] libxstream-java security update",
                     refsource: "MLIST",
                     url: "https://lists.debian.org/debian-lts-announce/2021/07/msg00004.html",
                  },
                  {
                     name: "FEDORA-2021-fbad11014a",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/",
                  },
                  {
                     name: "FEDORA-2021-d894ca87dc",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/",
                  },
                  {
                     name: "https://www.oracle.com/security-alerts/cpuoct2021.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com/security-alerts/cpuoct2021.html",
                  },
                  {
                     name: "https://security.netapp.com/advisory/ntap-20210708-0007/",
                     refsource: "CONFIRM",
                     url: "https://security.netapp.com/advisory/ntap-20210708-0007/",
                  },
                  {
                     name: "FEDORA-2021-5e376c0ed9",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/",
                  },
                  {
                     name: "DSA-5004",
                     refsource: "DEBIAN",
                     url: "https://www.debian.org/security/2021/dsa-5004",
                  },
                  {
                     name: "https://www.oracle.com/security-alerts/cpujan2022.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com/security-alerts/cpujan2022.html",
                  },
                  {
                     name: "https://www.oracle.com/security-alerts/cpuapr2022.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com/security-alerts/cpuapr2022.html",
                  },
                  {
                     name: "https://www.oracle.com/security-alerts/cpujul2022.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com/security-alerts/cpujul2022.html",
                  },
               ],
            },
            source: {
               advisory: "GHSA-7chv-rrw6-w6fc",
               discovery: "UNKNOWN",
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
      assignerShortName: "GitHub_M",
      cveId: "CVE-2021-29505",
      datePublished: "2021-05-28T21:00:19",
      dateReserved: "2021-03-30T00:00:00",
      dateUpdated: "2024-08-03T22:11:05.321Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2021-21343

Vulnerability from cvelistv5

Published

2021-03-22 23:40

Modified

2024-08-03 18:09

Severity ?

5.3 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N

Summary

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability where the processed stream at unmarshalling time contains type information to recreate the formerly written objects. XStream creates therefore new instances based on these type information. An attacker can manipulate the processed input stream and replace or inject objects, that result in the deletion of a file on the local host. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.

References

▼	URL	Tags
	https://x-stream.github.io/security.html#workaround	x_refsource_MISC
	http://x-stream.github.io/changes.html#1.4.16	x_refsource_MISC
	https://github.com/x-stream/xstream/security/advisories/GHSA-74cv-f58x-f9wf	x_refsource_CONFIRM
	https://x-stream.github.io/CVE-2021-21343.html	x_refsource_MISC
	https://lists.debian.org/debian-lts-announce/2021/04/msg00002.html	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fac48b425c6e16b0%40%3Cdev.jmeter.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae655414d23ed0dd%40%3Cusers.activemq.apache.org%3E	mailing-list, x_refsource_MLIST
	https://security.netapp.com/advisory/ntap-20210430-0002/	x_refsource_CONFIRM
	https://www.oracle.com//security-alerts/cpujul2021.html	x_refsource_MISC
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/	vendor-advisory, x_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/	vendor-advisory, x_refsource_FEDORA
	https://www.oracle.com/security-alerts/cpuoct2021.html	x_refsource_MISC
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/	vendor-advisory, x_refsource_FEDORA
	https://www.debian.org/security/2021/dsa-5004	vendor-advisory, x_refsource_DEBIAN
	https://www.oracle.com/security-alerts/cpujan2022.html	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	x-stream	xstream	Version: < 1.4.16

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T18:09:15.634Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://x-stream.github.io/security.html#workaround",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "http://x-stream.github.io/changes.html#1.4.16",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://github.com/x-stream/xstream/security/advisories/GHSA-74cv-f58x-f9wf",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://x-stream.github.io/CVE-2021-21343.html",
               },
               {
                  name: "[debian-lts-announce] 20210403 [SECURITY] [DLA 2616-1] libxstream-java security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2021/04/msg00002.html",
               },
               {
                  name: "[jmeter-dev] 20210406 [GitHub] [jmeter] sseide opened a new pull request #655: update x-stream to 1.4.16 (from 1.4.15)",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fac48b425c6e16b0%40%3Cdev.jmeter.apache.org%3E",
               },
               {
                  name: "[activemq-users] 20210427 Release date for ActiveMQ v5.16.2 to fix CVEs",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae655414d23ed0dd%40%3Cusers.activemq.apache.org%3E",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20210430-0002/",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com//security-alerts/cpujul2021.html",
               },
               {
                  name: "FEDORA-2021-fbad11014a",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/",
               },
               {
                  name: "FEDORA-2021-d894ca87dc",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpuoct2021.html",
               },
               {
                  name: "FEDORA-2021-5e376c0ed9",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/",
               },
               {
                  name: "DSA-5004",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_DEBIAN",
                     "x_transferred",
                  ],
                  url: "https://www.debian.org/security/2021/dsa-5004",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpujan2022.html",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "xstream",
               vendor: "x-stream",
               versions: [
                  {
                     status: "affected",
                     version: "< 1.4.16",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability where the processed stream at unmarshalling time contains type information to recreate the formerly written objects. XStream creates therefore new instances based on these type information. An attacker can manipulate the processed input stream and replace or inject objects, that result in the deletion of a file on the local host. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 5.3,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "NONE",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-73",
                     description: "CWE-73 External Control of File Name or Path",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
            {
               descriptions: [
                  {
                     cweId: "CWE-502",
                     description: "CWE-502 Deserialization of Untrusted Data",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-02-07T14:41:15",
            orgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
            shortName: "GitHub_M",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://x-stream.github.io/security.html#workaround",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "http://x-stream.github.io/changes.html#1.4.16",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://github.com/x-stream/xstream/security/advisories/GHSA-74cv-f58x-f9wf",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://x-stream.github.io/CVE-2021-21343.html",
            },
            {
               name: "[debian-lts-announce] 20210403 [SECURITY] [DLA 2616-1] libxstream-java security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2021/04/msg00002.html",
            },
            {
               name: "[jmeter-dev] 20210406 [GitHub] [jmeter] sseide opened a new pull request #655: update x-stream to 1.4.16 (from 1.4.15)",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fac48b425c6e16b0%40%3Cdev.jmeter.apache.org%3E",
            },
            {
               name: "[activemq-users] 20210427 Release date for ActiveMQ v5.16.2 to fix CVEs",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae655414d23ed0dd%40%3Cusers.activemq.apache.org%3E",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://security.netapp.com/advisory/ntap-20210430-0002/",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com//security-alerts/cpujul2021.html",
            },
            {
               name: "FEDORA-2021-fbad11014a",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/",
            },
            {
               name: "FEDORA-2021-d894ca87dc",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com/security-alerts/cpuoct2021.html",
            },
            {
               name: "FEDORA-2021-5e376c0ed9",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/",
            },
            {
               name: "DSA-5004",
               tags: [
                  "vendor-advisory",
                  "x_refsource_DEBIAN",
               ],
               url: "https://www.debian.org/security/2021/dsa-5004",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com/security-alerts/cpujan2022.html",
            },
         ],
         source: {
            advisory: "GHSA-74cv-f58x-f9wf",
            discovery: "UNKNOWN",
         },
         title: "XStream is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling as long as the executing process has sufficient rights",
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "security-advisories@github.com",
               ID: "CVE-2021-21343",
               STATE: "PUBLIC",
               TITLE: "XStream is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling as long as the executing process has sufficient rights",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "xstream",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "< 1.4.16",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "x-stream",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability where the processed stream at unmarshalling time contains type information to recreate the formerly written objects. XStream creates therefore new instances based on these type information. An attacker can manipulate the processed input stream and replace or inject objects, that result in the deletion of a file on the local host. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.",
                  },
               ],
            },
            impact: {
               cvss: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 5.3,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "NONE",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N",
                  version: "3.1",
               },
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-73 External Control of File Name or Path",
                        },
                     ],
                  },
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-502 Deserialization of Untrusted Data",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://x-stream.github.io/security.html#workaround",
                     refsource: "MISC",
                     url: "https://x-stream.github.io/security.html#workaround",
                  },
                  {
                     name: "http://x-stream.github.io/changes.html#1.4.16",
                     refsource: "MISC",
                     url: "http://x-stream.github.io/changes.html#1.4.16",
                  },
                  {
                     name: "https://github.com/x-stream/xstream/security/advisories/GHSA-74cv-f58x-f9wf",
                     refsource: "CONFIRM",
                     url: "https://github.com/x-stream/xstream/security/advisories/GHSA-74cv-f58x-f9wf",
                  },
                  {
                     name: "https://x-stream.github.io/CVE-2021-21343.html",
                     refsource: "MISC",
                     url: "https://x-stream.github.io/CVE-2021-21343.html",
                  },
                  {
                     name: "[debian-lts-announce] 20210403 [SECURITY] [DLA 2616-1] libxstream-java security update",
                     refsource: "MLIST",
                     url: "https://lists.debian.org/debian-lts-announce/2021/04/msg00002.html",
                  },
                  {
                     name: "[jmeter-dev] 20210406 [GitHub] [jmeter] sseide opened a new pull request #655: update x-stream to 1.4.16 (from 1.4.15)",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fac48b425c6e16b0@%3Cdev.jmeter.apache.org%3E",
                  },
                  {
                     name: "[activemq-users] 20210427 Release date for ActiveMQ v5.16.2 to fix CVEs",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae655414d23ed0dd@%3Cusers.activemq.apache.org%3E",
                  },
                  {
                     name: "https://security.netapp.com/advisory/ntap-20210430-0002/",
                     refsource: "CONFIRM",
                     url: "https://security.netapp.com/advisory/ntap-20210430-0002/",
                  },
                  {
                     name: "https://www.oracle.com//security-alerts/cpujul2021.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com//security-alerts/cpujul2021.html",
                  },
                  {
                     name: "FEDORA-2021-fbad11014a",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/",
                  },
                  {
                     name: "FEDORA-2021-d894ca87dc",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/",
                  },
                  {
                     name: "https://www.oracle.com/security-alerts/cpuoct2021.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com/security-alerts/cpuoct2021.html",
                  },
                  {
                     name: "FEDORA-2021-5e376c0ed9",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/",
                  },
                  {
                     name: "DSA-5004",
                     refsource: "DEBIAN",
                     url: "https://www.debian.org/security/2021/dsa-5004",
                  },
                  {
                     name: "https://www.oracle.com/security-alerts/cpujan2022.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com/security-alerts/cpujan2022.html",
                  },
               ],
            },
            source: {
               advisory: "GHSA-74cv-f58x-f9wf",
               discovery: "UNKNOWN",
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
      assignerShortName: "GitHub_M",
      cveId: "CVE-2021-21343",
      datePublished: "2021-03-22T23:40:34",
      dateReserved: "2020-12-22T00:00:00",
      dateUpdated: "2024-08-03T18:09:15.634Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2021-21348

Vulnerability from cvelistv5

Published

2021-03-22 23:45

Modified

2024-08-03 18:09

Severity ?

5.3 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H

Summary

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to occupy a thread that consumes maximum CPU time and will never return. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.

References

▼	URL	Tags
	https://x-stream.github.io/security.html#workaround	x_refsource_MISC
	http://x-stream.github.io/changes.html#1.4.16	x_refsource_MISC
	https://github.com/x-stream/xstream/security/advisories/GHSA-56p8-3fh9-4cvq	x_refsource_CONFIRM
	https://x-stream.github.io/CVE-2021-21348.html	x_refsource_MISC
	https://lists.debian.org/debian-lts-announce/2021/04/msg00002.html	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fac48b425c6e16b0%40%3Cdev.jmeter.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae655414d23ed0dd%40%3Cusers.activemq.apache.org%3E	mailing-list, x_refsource_MLIST
	https://security.netapp.com/advisory/ntap-20210430-0002/	x_refsource_CONFIRM
	https://www.oracle.com//security-alerts/cpujul2021.html	x_refsource_MISC
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/	vendor-advisory, x_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/	vendor-advisory, x_refsource_FEDORA
	https://www.oracle.com/security-alerts/cpuoct2021.html	x_refsource_MISC
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/	vendor-advisory, x_refsource_FEDORA
	https://www.debian.org/security/2021/dsa-5004	vendor-advisory, x_refsource_DEBIAN
	https://www.oracle.com/security-alerts/cpujan2022.html	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	x-stream	xstream	Version: < 1.4.16

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T18:09:15.691Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://x-stream.github.io/security.html#workaround",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "http://x-stream.github.io/changes.html#1.4.16",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://github.com/x-stream/xstream/security/advisories/GHSA-56p8-3fh9-4cvq",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://x-stream.github.io/CVE-2021-21348.html",
               },
               {
                  name: "[debian-lts-announce] 20210403 [SECURITY] [DLA 2616-1] libxstream-java security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2021/04/msg00002.html",
               },
               {
                  name: "[jmeter-dev] 20210406 [GitHub] [jmeter] sseide opened a new pull request #655: update x-stream to 1.4.16 (from 1.4.15)",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fac48b425c6e16b0%40%3Cdev.jmeter.apache.org%3E",
               },
               {
                  name: "[activemq-users] 20210427 Release date for ActiveMQ v5.16.2 to fix CVEs",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae655414d23ed0dd%40%3Cusers.activemq.apache.org%3E",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20210430-0002/",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com//security-alerts/cpujul2021.html",
               },
               {
                  name: "FEDORA-2021-fbad11014a",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/",
               },
               {
                  name: "FEDORA-2021-d894ca87dc",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpuoct2021.html",
               },
               {
                  name: "FEDORA-2021-5e376c0ed9",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/",
               },
               {
                  name: "DSA-5004",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_DEBIAN",
                     "x_transferred",
                  ],
                  url: "https://www.debian.org/security/2021/dsa-5004",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpujan2022.html",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "xstream",
               vendor: "x-stream",
               versions: [
                  {
                     status: "affected",
                     version: "< 1.4.16",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to occupy a thread that consumes maximum CPU time and will never return. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 5.3,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-400",
                     description: "CWE-400 Uncontrolled Resource Consumption",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
            {
               descriptions: [
                  {
                     cweId: "CWE-502",
                     description: "CWE-502 Deserialization of Untrusted Data",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-02-07T14:41:20",
            orgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
            shortName: "GitHub_M",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://x-stream.github.io/security.html#workaround",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "http://x-stream.github.io/changes.html#1.4.16",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://github.com/x-stream/xstream/security/advisories/GHSA-56p8-3fh9-4cvq",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://x-stream.github.io/CVE-2021-21348.html",
            },
            {
               name: "[debian-lts-announce] 20210403 [SECURITY] [DLA 2616-1] libxstream-java security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2021/04/msg00002.html",
            },
            {
               name: "[jmeter-dev] 20210406 [GitHub] [jmeter] sseide opened a new pull request #655: update x-stream to 1.4.16 (from 1.4.15)",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fac48b425c6e16b0%40%3Cdev.jmeter.apache.org%3E",
            },
            {
               name: "[activemq-users] 20210427 Release date for ActiveMQ v5.16.2 to fix CVEs",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae655414d23ed0dd%40%3Cusers.activemq.apache.org%3E",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://security.netapp.com/advisory/ntap-20210430-0002/",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com//security-alerts/cpujul2021.html",
            },
            {
               name: "FEDORA-2021-fbad11014a",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/",
            },
            {
               name: "FEDORA-2021-d894ca87dc",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com/security-alerts/cpuoct2021.html",
            },
            {
               name: "FEDORA-2021-5e376c0ed9",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/",
            },
            {
               name: "DSA-5004",
               tags: [
                  "vendor-advisory",
                  "x_refsource_DEBIAN",
               ],
               url: "https://www.debian.org/security/2021/dsa-5004",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com/security-alerts/cpujan2022.html",
            },
         ],
         source: {
            advisory: "GHSA-56p8-3fh9-4cvq",
            discovery: "UNKNOWN",
         },
         title: "XStream is vulnerable to an attack using Regular Expression for a Denial of Service (ReDos)",
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "security-advisories@github.com",
               ID: "CVE-2021-21348",
               STATE: "PUBLIC",
               TITLE: "XStream is vulnerable to an attack using Regular Expression for a Denial of Service (ReDos)",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "xstream",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "< 1.4.16",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "x-stream",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to occupy a thread that consumes maximum CPU time and will never return. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.",
                  },
               ],
            },
            impact: {
               cvss: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 5.3,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-400 Uncontrolled Resource Consumption",
                        },
                     ],
                  },
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-502 Deserialization of Untrusted Data",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://x-stream.github.io/security.html#workaround",
                     refsource: "MISC",
                     url: "https://x-stream.github.io/security.html#workaround",
                  },
                  {
                     name: "http://x-stream.github.io/changes.html#1.4.16",
                     refsource: "MISC",
                     url: "http://x-stream.github.io/changes.html#1.4.16",
                  },
                  {
                     name: "https://github.com/x-stream/xstream/security/advisories/GHSA-56p8-3fh9-4cvq",
                     refsource: "CONFIRM",
                     url: "https://github.com/x-stream/xstream/security/advisories/GHSA-56p8-3fh9-4cvq",
                  },
                  {
                     name: "https://x-stream.github.io/CVE-2021-21348.html",
                     refsource: "MISC",
                     url: "https://x-stream.github.io/CVE-2021-21348.html",
                  },
                  {
                     name: "[debian-lts-announce] 20210403 [SECURITY] [DLA 2616-1] libxstream-java security update",
                     refsource: "MLIST",
                     url: "https://lists.debian.org/debian-lts-announce/2021/04/msg00002.html",
                  },
                  {
                     name: "[jmeter-dev] 20210406 [GitHub] [jmeter] sseide opened a new pull request #655: update x-stream to 1.4.16 (from 1.4.15)",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fac48b425c6e16b0@%3Cdev.jmeter.apache.org%3E",
                  },
                  {
                     name: "[activemq-users] 20210427 Release date for ActiveMQ v5.16.2 to fix CVEs",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae655414d23ed0dd@%3Cusers.activemq.apache.org%3E",
                  },
                  {
                     name: "https://security.netapp.com/advisory/ntap-20210430-0002/",
                     refsource: "CONFIRM",
                     url: "https://security.netapp.com/advisory/ntap-20210430-0002/",
                  },
                  {
                     name: "https://www.oracle.com//security-alerts/cpujul2021.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com//security-alerts/cpujul2021.html",
                  },
                  {
                     name: "FEDORA-2021-fbad11014a",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/",
                  },
                  {
                     name: "FEDORA-2021-d894ca87dc",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/",
                  },
                  {
                     name: "https://www.oracle.com/security-alerts/cpuoct2021.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com/security-alerts/cpuoct2021.html",
                  },
                  {
                     name: "FEDORA-2021-5e376c0ed9",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/",
                  },
                  {
                     name: "DSA-5004",
                     refsource: "DEBIAN",
                     url: "https://www.debian.org/security/2021/dsa-5004",
                  },
                  {
                     name: "https://www.oracle.com/security-alerts/cpujan2022.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com/security-alerts/cpujan2022.html",
                  },
               ],
            },
            source: {
               advisory: "GHSA-56p8-3fh9-4cvq",
               discovery: "UNKNOWN",
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
      assignerShortName: "GitHub_M",
      cveId: "CVE-2021-21348",
      datePublished: "2021-03-22T23:45:29",
      dateReserved: "2020-12-22T00:00:00",
      dateUpdated: "2024-08-03T18:09:15.691Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2021-21351

Vulnerability from cvelistv5

Published

2021-03-22 23:45

Modified

2024-08-03 18:09

Severity ?

5.4 (Medium) - CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:N/I:H/A:N

Summary

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.

References

▼	URL	Tags
	https://x-stream.github.io/security.html#workaround	x_refsource_MISC
	http://x-stream.github.io/changes.html#1.4.16	x_refsource_MISC
	https://github.com/x-stream/xstream/security/advisories/GHSA-hrcp-8f3q-4w2c	x_refsource_CONFIRM
	https://x-stream.github.io/CVE-2021-21351.html	x_refsource_MISC
	https://lists.debian.org/debian-lts-announce/2021/04/msg00002.html	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fac48b425c6e16b0%40%3Cdev.jmeter.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae655414d23ed0dd%40%3Cusers.activemq.apache.org%3E	mailing-list, x_refsource_MLIST
	https://security.netapp.com/advisory/ntap-20210430-0002/	x_refsource_CONFIRM
	https://www.oracle.com//security-alerts/cpujul2021.html	x_refsource_MISC
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/	vendor-advisory, x_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/	vendor-advisory, x_refsource_FEDORA
	https://www.oracle.com/security-alerts/cpuoct2021.html	x_refsource_MISC
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/	vendor-advisory, x_refsource_FEDORA
	https://www.debian.org/security/2021/dsa-5004	vendor-advisory, x_refsource_DEBIAN
	https://www.oracle.com/security-alerts/cpujan2022.html	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	x-stream	xstream	Version: < 1.4.16

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T18:09:15.774Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://x-stream.github.io/security.html#workaround",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "http://x-stream.github.io/changes.html#1.4.16",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://github.com/x-stream/xstream/security/advisories/GHSA-hrcp-8f3q-4w2c",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://x-stream.github.io/CVE-2021-21351.html",
               },
               {
                  name: "[debian-lts-announce] 20210403 [SECURITY] [DLA 2616-1] libxstream-java security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2021/04/msg00002.html",
               },
               {
                  name: "[jmeter-dev] 20210406 [GitHub] [jmeter] sseide opened a new pull request #655: update x-stream to 1.4.16 (from 1.4.15)",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fac48b425c6e16b0%40%3Cdev.jmeter.apache.org%3E",
               },
               {
                  name: "[activemq-users] 20210427 Release date for ActiveMQ v5.16.2 to fix CVEs",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae655414d23ed0dd%40%3Cusers.activemq.apache.org%3E",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20210430-0002/",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com//security-alerts/cpujul2021.html",
               },
               {
                  name: "FEDORA-2021-fbad11014a",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/",
               },
               {
                  name: "FEDORA-2021-d894ca87dc",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpuoct2021.html",
               },
               {
                  name: "FEDORA-2021-5e376c0ed9",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/",
               },
               {
                  name: "DSA-5004",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_DEBIAN",
                     "x_transferred",
                  ],
                  url: "https://www.debian.org/security/2021/dsa-5004",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpujan2022.html",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "xstream",
               vendor: "x-stream",
               versions: [
                  {
                     status: "affected",
                     version: "< 1.4.16",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 5.4,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "NONE",
                  integrityImpact: "HIGH",
                  privilegesRequired: "HIGH",
                  scope: "CHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:N/I:H/A:N",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-434",
                     description: "CWE-434 Unrestricted Upload of File with Dangerous Type",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
            {
               descriptions: [
                  {
                     cweId: "CWE-502",
                     description: "CWE-502 Deserialization of Untrusted Data",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-02-07T14:41:23",
            orgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
            shortName: "GitHub_M",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://x-stream.github.io/security.html#workaround",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "http://x-stream.github.io/changes.html#1.4.16",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://github.com/x-stream/xstream/security/advisories/GHSA-hrcp-8f3q-4w2c",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://x-stream.github.io/CVE-2021-21351.html",
            },
            {
               name: "[debian-lts-announce] 20210403 [SECURITY] [DLA 2616-1] libxstream-java security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2021/04/msg00002.html",
            },
            {
               name: "[jmeter-dev] 20210406 [GitHub] [jmeter] sseide opened a new pull request #655: update x-stream to 1.4.16 (from 1.4.15)",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fac48b425c6e16b0%40%3Cdev.jmeter.apache.org%3E",
            },
            {
               name: "[activemq-users] 20210427 Release date for ActiveMQ v5.16.2 to fix CVEs",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae655414d23ed0dd%40%3Cusers.activemq.apache.org%3E",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://security.netapp.com/advisory/ntap-20210430-0002/",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com//security-alerts/cpujul2021.html",
            },
            {
               name: "FEDORA-2021-fbad11014a",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/",
            },
            {
               name: "FEDORA-2021-d894ca87dc",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com/security-alerts/cpuoct2021.html",
            },
            {
               name: "FEDORA-2021-5e376c0ed9",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/",
            },
            {
               name: "DSA-5004",
               tags: [
                  "vendor-advisory",
                  "x_refsource_DEBIAN",
               ],
               url: "https://www.debian.org/security/2021/dsa-5004",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com/security-alerts/cpujan2022.html",
            },
         ],
         source: {
            advisory: "GHSA-hrcp-8f3q-4w2c",
            discovery: "UNKNOWN",
         },
         title: "XStream is vulnerable to an Arbitrary Code Execution attack",
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "security-advisories@github.com",
               ID: "CVE-2021-21351",
               STATE: "PUBLIC",
               TITLE: "XStream is vulnerable to an Arbitrary Code Execution attack",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "xstream",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "< 1.4.16",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "x-stream",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.",
                  },
               ],
            },
            impact: {
               cvss: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 5.4,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "NONE",
                  integrityImpact: "HIGH",
                  privilegesRequired: "HIGH",
                  scope: "CHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:N/I:H/A:N",
                  version: "3.1",
               },
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-434 Unrestricted Upload of File with Dangerous Type",
                        },
                     ],
                  },
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-502 Deserialization of Untrusted Data",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://x-stream.github.io/security.html#workaround",
                     refsource: "MISC",
                     url: "https://x-stream.github.io/security.html#workaround",
                  },
                  {
                     name: "http://x-stream.github.io/changes.html#1.4.16",
                     refsource: "MISC",
                     url: "http://x-stream.github.io/changes.html#1.4.16",
                  },
                  {
                     name: "https://github.com/x-stream/xstream/security/advisories/GHSA-hrcp-8f3q-4w2c",
                     refsource: "CONFIRM",
                     url: "https://github.com/x-stream/xstream/security/advisories/GHSA-hrcp-8f3q-4w2c",
                  },
                  {
                     name: "https://x-stream.github.io/CVE-2021-21351.html",
                     refsource: "MISC",
                     url: "https://x-stream.github.io/CVE-2021-21351.html",
                  },
                  {
                     name: "[debian-lts-announce] 20210403 [SECURITY] [DLA 2616-1] libxstream-java security update",
                     refsource: "MLIST",
                     url: "https://lists.debian.org/debian-lts-announce/2021/04/msg00002.html",
                  },
                  {
                     name: "[jmeter-dev] 20210406 [GitHub] [jmeter] sseide opened a new pull request #655: update x-stream to 1.4.16 (from 1.4.15)",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fac48b425c6e16b0@%3Cdev.jmeter.apache.org%3E",
                  },
                  {
                     name: "[activemq-users] 20210427 Release date for ActiveMQ v5.16.2 to fix CVEs",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae655414d23ed0dd@%3Cusers.activemq.apache.org%3E",
                  },
                  {
                     name: "https://security.netapp.com/advisory/ntap-20210430-0002/",
                     refsource: "CONFIRM",
                     url: "https://security.netapp.com/advisory/ntap-20210430-0002/",
                  },
                  {
                     name: "https://www.oracle.com//security-alerts/cpujul2021.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com//security-alerts/cpujul2021.html",
                  },
                  {
                     name: "FEDORA-2021-fbad11014a",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/",
                  },
                  {
                     name: "FEDORA-2021-d894ca87dc",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/",
                  },
                  {
                     name: "https://www.oracle.com/security-alerts/cpuoct2021.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com/security-alerts/cpuoct2021.html",
                  },
                  {
                     name: "FEDORA-2021-5e376c0ed9",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/",
                  },
                  {
                     name: "DSA-5004",
                     refsource: "DEBIAN",
                     url: "https://www.debian.org/security/2021/dsa-5004",
                  },
                  {
                     name: "https://www.oracle.com/security-alerts/cpujan2022.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com/security-alerts/cpujan2022.html",
                  },
               ],
            },
            source: {
               advisory: "GHSA-hrcp-8f3q-4w2c",
               discovery: "UNKNOWN",
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
      assignerShortName: "GitHub_M",
      cveId: "CVE-2021-21351",
      datePublished: "2021-03-22T23:45:15",
      dateReserved: "2020-12-22T00:00:00",
      dateUpdated: "2024-08-03T18:09:15.774Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2021-21344

Vulnerability from cvelistv5

Published

2021-03-22 23:40

Modified

2024-08-03 18:09

Severity ?

5.3 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N

Summary

References

▼	URL	Tags
	https://x-stream.github.io/security.html#workaround	x_refsource_MISC
	http://x-stream.github.io/changes.html#1.4.16	x_refsource_MISC
	https://github.com/x-stream/xstream/security/advisories/GHSA-59jw-jqf4-3wq3	x_refsource_CONFIRM
	https://x-stream.github.io/CVE-2021-21344.html	x_refsource_MISC
	https://lists.debian.org/debian-lts-announce/2021/04/msg00002.html	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fac48b425c6e16b0%40%3Cdev.jmeter.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae655414d23ed0dd%40%3Cusers.activemq.apache.org%3E	mailing-list, x_refsource_MLIST
	https://security.netapp.com/advisory/ntap-20210430-0002/	x_refsource_CONFIRM
	https://www.oracle.com//security-alerts/cpujul2021.html	x_refsource_MISC
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/	vendor-advisory, x_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/	vendor-advisory, x_refsource_FEDORA
	https://www.oracle.com/security-alerts/cpuoct2021.html	x_refsource_MISC
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/	vendor-advisory, x_refsource_FEDORA
	https://www.debian.org/security/2021/dsa-5004	vendor-advisory, x_refsource_DEBIAN
	https://www.oracle.com/security-alerts/cpujan2022.html	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	x-stream	xstream	Version: < 1.4.16

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T18:09:15.795Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://x-stream.github.io/security.html#workaround",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "http://x-stream.github.io/changes.html#1.4.16",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://github.com/x-stream/xstream/security/advisories/GHSA-59jw-jqf4-3wq3",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://x-stream.github.io/CVE-2021-21344.html",
               },
               {
                  name: "[debian-lts-announce] 20210403 [SECURITY] [DLA 2616-1] libxstream-java security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2021/04/msg00002.html",
               },
               {
                  name: "[jmeter-dev] 20210406 [GitHub] [jmeter] sseide opened a new pull request #655: update x-stream to 1.4.16 (from 1.4.15)",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fac48b425c6e16b0%40%3Cdev.jmeter.apache.org%3E",
               },
               {
                  name: "[activemq-users] 20210427 Release date for ActiveMQ v5.16.2 to fix CVEs",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae655414d23ed0dd%40%3Cusers.activemq.apache.org%3E",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20210430-0002/",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com//security-alerts/cpujul2021.html",
               },
               {
                  name: "FEDORA-2021-fbad11014a",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/",
               },
               {
                  name: "FEDORA-2021-d894ca87dc",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpuoct2021.html",
               },
               {
                  name: "FEDORA-2021-5e376c0ed9",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/",
               },
               {
                  name: "DSA-5004",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_DEBIAN",
                     "x_transferred",
                  ],
                  url: "https://www.debian.org/security/2021/dsa-5004",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpujan2022.html",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "xstream",
               vendor: "x-stream",
               versions: [
                  {
                     status: "affected",
                     version: "< 1.4.16",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 5.3,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "NONE",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-434",
                     description: "CWE-434 Unrestricted Upload of File with Dangerous Type",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
            {
               descriptions: [
                  {
                     cweId: "CWE-502",
                     description: "CWE-502 Deserialization of Untrusted Data",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-02-07T14:41:16",
            orgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
            shortName: "GitHub_M",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://x-stream.github.io/security.html#workaround",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "http://x-stream.github.io/changes.html#1.4.16",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://github.com/x-stream/xstream/security/advisories/GHSA-59jw-jqf4-3wq3",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://x-stream.github.io/CVE-2021-21344.html",
            },
            {
               name: "[debian-lts-announce] 20210403 [SECURITY] [DLA 2616-1] libxstream-java security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2021/04/msg00002.html",
            },
            {
               name: "[jmeter-dev] 20210406 [GitHub] [jmeter] sseide opened a new pull request #655: update x-stream to 1.4.16 (from 1.4.15)",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fac48b425c6e16b0%40%3Cdev.jmeter.apache.org%3E",
            },
            {
               name: "[activemq-users] 20210427 Release date for ActiveMQ v5.16.2 to fix CVEs",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae655414d23ed0dd%40%3Cusers.activemq.apache.org%3E",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://security.netapp.com/advisory/ntap-20210430-0002/",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com//security-alerts/cpujul2021.html",
            },
            {
               name: "FEDORA-2021-fbad11014a",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/",
            },
            {
               name: "FEDORA-2021-d894ca87dc",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com/security-alerts/cpuoct2021.html",
            },
            {
               name: "FEDORA-2021-5e376c0ed9",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/",
            },
            {
               name: "DSA-5004",
               tags: [
                  "vendor-advisory",
                  "x_refsource_DEBIAN",
               ],
               url: "https://www.debian.org/security/2021/dsa-5004",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com/security-alerts/cpujan2022.html",
            },
         ],
         source: {
            advisory: "GHSA-59jw-jqf4-3wq3",
            discovery: "UNKNOWN",
         },
         title: "XStream is vulnerable to an Arbitrary Code Execution attack",
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "security-advisories@github.com",
               ID: "CVE-2021-21344",
               STATE: "PUBLIC",
               TITLE: "XStream is vulnerable to an Arbitrary Code Execution attack",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "xstream",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "< 1.4.16",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "x-stream",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.",
                  },
               ],
            },
            impact: {
               cvss: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 5.3,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "NONE",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N",
                  version: "3.1",
               },
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-434 Unrestricted Upload of File with Dangerous Type",
                        },
                     ],
                  },
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-502 Deserialization of Untrusted Data",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://x-stream.github.io/security.html#workaround",
                     refsource: "MISC",
                     url: "https://x-stream.github.io/security.html#workaround",
                  },
                  {
                     name: "http://x-stream.github.io/changes.html#1.4.16",
                     refsource: "MISC",
                     url: "http://x-stream.github.io/changes.html#1.4.16",
                  },
                  {
                     name: "https://github.com/x-stream/xstream/security/advisories/GHSA-59jw-jqf4-3wq3",
                     refsource: "CONFIRM",
                     url: "https://github.com/x-stream/xstream/security/advisories/GHSA-59jw-jqf4-3wq3",
                  },
                  {
                     name: "https://x-stream.github.io/CVE-2021-21344.html",
                     refsource: "MISC",
                     url: "https://x-stream.github.io/CVE-2021-21344.html",
                  },
                  {
                     name: "[debian-lts-announce] 20210403 [SECURITY] [DLA 2616-1] libxstream-java security update",
                     refsource: "MLIST",
                     url: "https://lists.debian.org/debian-lts-announce/2021/04/msg00002.html",
                  },
                  {
                     name: "[jmeter-dev] 20210406 [GitHub] [jmeter] sseide opened a new pull request #655: update x-stream to 1.4.16 (from 1.4.15)",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fac48b425c6e16b0@%3Cdev.jmeter.apache.org%3E",
                  },
                  {
                     name: "[activemq-users] 20210427 Release date for ActiveMQ v5.16.2 to fix CVEs",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae655414d23ed0dd@%3Cusers.activemq.apache.org%3E",
                  },
                  {
                     name: "https://security.netapp.com/advisory/ntap-20210430-0002/",
                     refsource: "CONFIRM",
                     url: "https://security.netapp.com/advisory/ntap-20210430-0002/",
                  },
                  {
                     name: "https://www.oracle.com//security-alerts/cpujul2021.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com//security-alerts/cpujul2021.html",
                  },
                  {
                     name: "FEDORA-2021-fbad11014a",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/",
                  },
                  {
                     name: "FEDORA-2021-d894ca87dc",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/",
                  },
                  {
                     name: "https://www.oracle.com/security-alerts/cpuoct2021.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com/security-alerts/cpuoct2021.html",
                  },
                  {
                     name: "FEDORA-2021-5e376c0ed9",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/",
                  },
                  {
                     name: "DSA-5004",
                     refsource: "DEBIAN",
                     url: "https://www.debian.org/security/2021/dsa-5004",
                  },
                  {
                     name: "https://www.oracle.com/security-alerts/cpujan2022.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com/security-alerts/cpujan2022.html",
                  },
               ],
            },
            source: {
               advisory: "GHSA-59jw-jqf4-3wq3",
               discovery: "UNKNOWN",
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
      assignerShortName: "GitHub_M",
      cveId: "CVE-2021-21344",
      datePublished: "2021-03-22T23:40:29",
      dateReserved: "2020-12-22T00:00:00",
      dateUpdated: "2024-08-03T18:09:15.795Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2020-26258

Vulnerability from cvelistv5

Published

2020-12-16 01:05

Modified

2025-01-15 20:20

Severity ?

6.3 (Medium) - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

Summary

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, a Server-Side Forgery Request vulnerability can be activated when unmarshalling. The vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.15. The reported vulnerability does not exist if running Java 15 or higher. No user is affected who followed the recommendation to setup XStream's Security Framework with a whitelist! Anyone relying on XStream's default blacklist can immediately switch to a whilelist for the allowed types to avoid the vulnerability. Users of XStream 1.4.14 or below who still want to use XStream default blacklist can use a workaround described in more detailed in the referenced advisories.

References

▼	URL	Tags
	https://github.com/x-stream/xstream/security/advisories/GHSA-4cch-wxpw-8p28	x_refsource_CONFIRM
	https://lists.apache.org/thread.html/r97993e3d78e1f5389b7b172ba9f308440830ce5f051ee62714a0aa34@%3Ccommits.struts.apache.org%3E	x_refsource_MISC
	https://lists.debian.org/debian-lts-announce/2020/12/msg00042.html	x_refsource_MISC
	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP	x_refsource_MISC
	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7	x_refsource_MISC
	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB	x_refsource_MISC
	https://security.netapp.com/advisory/ntap-20210409-0005	x_refsource_MISC
	https://www.debian.org/security/2021/dsa-4828	x_refsource_MISC
	https://x-stream.github.io/CVE-2020-26258.html	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	x-stream	xstream	Version: < 1.4.15

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T15:56:04.631Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://github.com/x-stream/xstream/security/advisories/GHSA-4cch-wxpw-8p28",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://x-stream.github.io/CVE-2020-26258.html",
               },
               {
                  name: "[struts-commits] 20201221 [struts] branch master updated: Upgrades XStream to version 1.4.15 to address CVE-2020-26258, CVE-2020-26259",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r97993e3d78e1f5389b7b172ba9f308440830ce5f051ee62714a0aa34%40%3Ccommits.struts.apache.org%3E",
               },
               {
                  name: "[debian-lts-announce] 20201231 [SECURITY] [DLA 2507-1] libxstream-java security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2020/12/msg00042.html",
               },
               {
                  name: "DSA-4828",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_DEBIAN",
                     "x_transferred",
                  ],
                  url: "https://www.debian.org/security/2021/dsa-4828",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20210409-0005/",
               },
               {
                  name: "FEDORA-2021-fbad11014a",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/",
               },
               {
                  name: "FEDORA-2021-d894ca87dc",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/",
               },
               {
                  name: "FEDORA-2021-5e376c0ed9",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "xstream",
               vendor: "x-stream",
               versions: [
                  {
                     status: "affected",
                     version: "< 1.4.15",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, a Server-Side Forgery Request vulnerability can be activated when unmarshalling. The vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.15. The reported vulnerability does not exist if running Java 15 or higher. No user is affected who followed the recommendation to setup XStream's Security Framework with a whitelist! Anyone relying on XStream's default blacklist can immediately switch to a whilelist for the allowed types to avoid the vulnerability. Users of XStream 1.4.14 or below who still want to use XStream default blacklist can use a workaround described in more detailed in the referenced advisories.",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 6.3,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "NONE",
                  privilegesRequired: "LOW",
                  scope: "CHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-918",
                     description: "CWE-918: Server-Side Request Forgery (SSRF)",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2025-01-15T20:20:17.971Z",
            orgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
            shortName: "GitHub_M",
         },
         references: [
            {
               name: "https://github.com/x-stream/xstream/security/advisories/GHSA-4cch-wxpw-8p28",
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://github.com/x-stream/xstream/security/advisories/GHSA-4cch-wxpw-8p28",
            },
            {
               name: "https://lists.apache.org/thread.html/r97993e3d78e1f5389b7b172ba9f308440830ce5f051ee62714a0aa34@%3Ccommits.struts.apache.org%3E",
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://lists.apache.org/thread.html/r97993e3d78e1f5389b7b172ba9f308440830ce5f051ee62714a0aa34@%3Ccommits.struts.apache.org%3E",
            },
            {
               name: "https://lists.debian.org/debian-lts-announce/2020/12/msg00042.html",
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2020/12/msg00042.html",
            },
            {
               name: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP",
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP",
            },
            {
               name: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7",
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7",
            },
            {
               name: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB",
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB",
            },
            {
               name: "https://security.netapp.com/advisory/ntap-20210409-0005",
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://security.netapp.com/advisory/ntap-20210409-0005",
            },
            {
               name: "https://www.debian.org/security/2021/dsa-4828",
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.debian.org/security/2021/dsa-4828",
            },
            {
               name: "https://x-stream.github.io/CVE-2020-26258.html",
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://x-stream.github.io/CVE-2020-26258.html",
            },
         ],
         source: {
            advisory: "GHSA-4cch-wxpw-8p28",
            discovery: "UNKNOWN",
         },
         title: "Server-Side Forgery Request can be activated unmarshalling with XStream",
      },
   },
   cveMetadata: {
      assignerOrgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
      assignerShortName: "GitHub_M",
      cveId: "CVE-2020-26258",
      datePublished: "2020-12-16T01:05:22",
      dateReserved: "2020-10-01T00:00:00",
      dateUpdated: "2025-01-15T20:20:17.971Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2016-3674

Vulnerability from cvelistv5

Published

2016-05-17 14:00

Modified

2024-08-06 00:03

Severity ?

Summary

Multiple XML external entity (XXE) vulnerabilities in the (1) Dom4JDriver, (2) DomDriver, (3) JDomDriver, (4) JDom2Driver, (5) SjsxpDriver, (6) StandardStaxDriver, and (7) WstxDriver drivers in XStream before 1.4.9 allow remote attackers to read arbitrary files via a crafted XML document.

References

▼	URL	Tags
	http://x-stream.github.io/changes.html#1.4.9	x_refsource_CONFIRM
	http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183180.html	vendor-advisory, x_refsource_FEDORA
	http://www.debian.org/security/2016/dsa-3575	vendor-advisory, x_refsource_DEBIAN
	http://rhn.redhat.com/errata/RHSA-2016-2822.html	vendor-advisory, x_refsource_REDHAT
	http://www.securityfocus.com/bid/85381	vdb-entry, x_refsource_BID
	http://www.securitytracker.com/id/1036419	vdb-entry, x_refsource_SECTRACK
	http://www.openwall.com/lists/oss-security/2016/03/28/1	mailing-list, x_refsource_MLIST
	http://rhn.redhat.com/errata/RHSA-2016-2823.html	vendor-advisory, x_refsource_REDHAT
	https://github.com/x-stream/xstream/issues/25	x_refsource_CONFIRM
	http://www.openwall.com/lists/oss-security/2016/03/25/8	mailing-list, x_refsource_MLIST
	http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183208.html	vendor-advisory, x_refsource_FEDORA

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-06T00:03:34.422Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "http://x-stream.github.io/changes.html#1.4.9",
               },
               {
                  name: "FEDORA-2016-de909cc333",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183180.html",
               },
               {
                  name: "DSA-3575",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_DEBIAN",
                     "x_transferred",
                  ],
                  url: "http://www.debian.org/security/2016/dsa-3575",
               },
               {
                  name: "RHSA-2016:2822",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "http://rhn.redhat.com/errata/RHSA-2016-2822.html",
               },
               {
                  name: "85381",
                  tags: [
                     "vdb-entry",
                     "x_refsource_BID",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/bid/85381",
               },
               {
                  name: "1036419",
                  tags: [
                     "vdb-entry",
                     "x_refsource_SECTRACK",
                     "x_transferred",
                  ],
                  url: "http://www.securitytracker.com/id/1036419",
               },
               {
                  name: "[oss-security] 20160328 Re: CVE request - XStream: XXE vulnerability",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2016/03/28/1",
               },
               {
                  name: "RHSA-2016:2823",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "http://rhn.redhat.com/errata/RHSA-2016-2823.html",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://github.com/x-stream/xstream/issues/25",
               },
               {
                  name: "[oss-security] 20160325 CVE request - XStream: XXE vulnerability",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2016/03/25/8",
               },
               {
                  name: "FEDORA-2016-250042b8a6",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183208.html",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         datePublic: "2016-03-15T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "Multiple XML external entity (XXE) vulnerabilities in the (1) Dom4JDriver, (2) DomDriver, (3) JDomDriver, (4) JDom2Driver, (5) SjsxpDriver, (6) StandardStaxDriver, and (7) WstxDriver drivers in XStream before 1.4.9 allow remote attackers to read arbitrary files via a crafted XML document.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2018-01-04T19:57:01",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "http://x-stream.github.io/changes.html#1.4.9",
            },
            {
               name: "FEDORA-2016-de909cc333",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183180.html",
            },
            {
               name: "DSA-3575",
               tags: [
                  "vendor-advisory",
                  "x_refsource_DEBIAN",
               ],
               url: "http://www.debian.org/security/2016/dsa-3575",
            },
            {
               name: "RHSA-2016:2822",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "http://rhn.redhat.com/errata/RHSA-2016-2822.html",
            },
            {
               name: "85381",
               tags: [
                  "vdb-entry",
                  "x_refsource_BID",
               ],
               url: "http://www.securityfocus.com/bid/85381",
            },
            {
               name: "1036419",
               tags: [
                  "vdb-entry",
                  "x_refsource_SECTRACK",
               ],
               url: "http://www.securitytracker.com/id/1036419",
            },
            {
               name: "[oss-security] 20160328 Re: CVE request - XStream: XXE vulnerability",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "http://www.openwall.com/lists/oss-security/2016/03/28/1",
            },
            {
               name: "RHSA-2016:2823",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "http://rhn.redhat.com/errata/RHSA-2016-2823.html",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://github.com/x-stream/xstream/issues/25",
            },
            {
               name: "[oss-security] 20160325 CVE request - XStream: XXE vulnerability",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "http://www.openwall.com/lists/oss-security/2016/03/25/8",
            },
            {
               name: "FEDORA-2016-250042b8a6",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183208.html",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "cve@mitre.org",
               ID: "CVE-2016-3674",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "n/a",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "n/a",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "Multiple XML external entity (XXE) vulnerabilities in the (1) Dom4JDriver, (2) DomDriver, (3) JDomDriver, (4) JDom2Driver, (5) SjsxpDriver, (6) StandardStaxDriver, and (7) WstxDriver drivers in XStream before 1.4.9 allow remote attackers to read arbitrary files via a crafted XML document.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "n/a",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "http://x-stream.github.io/changes.html#1.4.9",
                     refsource: "CONFIRM",
                     url: "http://x-stream.github.io/changes.html#1.4.9",
                  },
                  {
                     name: "FEDORA-2016-de909cc333",
                     refsource: "FEDORA",
                     url: "http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183180.html",
                  },
                  {
                     name: "DSA-3575",
                     refsource: "DEBIAN",
                     url: "http://www.debian.org/security/2016/dsa-3575",
                  },
                  {
                     name: "RHSA-2016:2822",
                     refsource: "REDHAT",
                     url: "http://rhn.redhat.com/errata/RHSA-2016-2822.html",
                  },
                  {
                     name: "85381",
                     refsource: "BID",
                     url: "http://www.securityfocus.com/bid/85381",
                  },
                  {
                     name: "1036419",
                     refsource: "SECTRACK",
                     url: "http://www.securitytracker.com/id/1036419",
                  },
                  {
                     name: "[oss-security] 20160328 Re: CVE request - XStream: XXE vulnerability",
                     refsource: "MLIST",
                     url: "http://www.openwall.com/lists/oss-security/2016/03/28/1",
                  },
                  {
                     name: "RHSA-2016:2823",
                     refsource: "REDHAT",
                     url: "http://rhn.redhat.com/errata/RHSA-2016-2823.html",
                  },
                  {
                     name: "https://github.com/x-stream/xstream/issues/25",
                     refsource: "CONFIRM",
                     url: "https://github.com/x-stream/xstream/issues/25",
                  },
                  {
                     name: "[oss-security] 20160325 CVE request - XStream: XXE vulnerability",
                     refsource: "MLIST",
                     url: "http://www.openwall.com/lists/oss-security/2016/03/25/8",
                  },
                  {
                     name: "FEDORA-2016-250042b8a6",
                     refsource: "FEDORA",
                     url: "http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183208.html",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2016-3674",
      datePublished: "2016-05-17T14:00:00",
      dateReserved: "2016-03-28T00:00:00",
      dateUpdated: "2024-08-06T00:03:34.422Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2021-39147

Vulnerability from cvelistv5

Published

2021-08-23 18:05

Modified

2024-08-04 01:58

Severity ?

8.5 (High) - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Summary

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.

References

▼	URL	Tags
	https://github.com/x-stream/xstream/security/advisories/GHSA-h7v4-7xg3-hxcc	x_refsource_CONFIRM
	https://x-stream.github.io/CVE-2021-39147.html	x_refsource_MISC
	https://lists.debian.org/debian-lts-announce/2021/09/msg00017.html	mailing-list, x_refsource_MLIST
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/	vendor-advisory, x_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/	vendor-advisory, x_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/	vendor-advisory, x_refsource_FEDORA
	https://www.debian.org/security/2021/dsa-5004	vendor-advisory, x_refsource_DEBIAN
	https://www.oracle.com/security-alerts/cpujan2022.html	x_refsource_MISC
	https://security.netapp.com/advisory/ntap-20210923-0003/	x_refsource_CONFIRM
	https://www.oracle.com/security-alerts/cpuapr2022.html	x_refsource_MISC
	https://www.oracle.com/security-alerts/cpujul2022.html	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	x-stream	xstream	Version: < 1.4.18

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T01:58:18.103Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://github.com/x-stream/xstream/security/advisories/GHSA-h7v4-7xg3-hxcc",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://x-stream.github.io/CVE-2021-39147.html",
               },
               {
                  name: "[debian-lts-announce] 20210929 [SECURITY] [DLA 2769-1] libxstream-java security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2021/09/msg00017.html",
               },
               {
                  name: "FEDORA-2021-fbad11014a",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/",
               },
               {
                  name: "FEDORA-2021-d894ca87dc",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/",
               },
               {
                  name: "FEDORA-2021-5e376c0ed9",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/",
               },
               {
                  name: "DSA-5004",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_DEBIAN",
                     "x_transferred",
                  ],
                  url: "https://www.debian.org/security/2021/dsa-5004",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpujan2022.html",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20210923-0003/",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpuapr2022.html",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpujul2022.html",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "xstream",
               vendor: "x-stream",
               versions: [
                  {
                     status: "affected",
                     version: "< 1.4.18 ",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 8.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "LOW",
                  scope: "CHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-434",
                     description: "CWE-434: Unrestricted Upload of File with Dangerous Type",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
            {
               descriptions: [
                  {
                     cweId: "CWE-502",
                     description: "CWE-502: Deserialization of Untrusted Data",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-07-25T16:33:16",
            orgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
            shortName: "GitHub_M",
         },
         references: [
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://github.com/x-stream/xstream/security/advisories/GHSA-h7v4-7xg3-hxcc",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://x-stream.github.io/CVE-2021-39147.html",
            },
            {
               name: "[debian-lts-announce] 20210929 [SECURITY] [DLA 2769-1] libxstream-java security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2021/09/msg00017.html",
            },
            {
               name: "FEDORA-2021-fbad11014a",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/",
            },
            {
               name: "FEDORA-2021-d894ca87dc",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/",
            },
            {
               name: "FEDORA-2021-5e376c0ed9",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/",
            },
            {
               name: "DSA-5004",
               tags: [
                  "vendor-advisory",
                  "x_refsource_DEBIAN",
               ],
               url: "https://www.debian.org/security/2021/dsa-5004",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com/security-alerts/cpujan2022.html",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://security.netapp.com/advisory/ntap-20210923-0003/",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com/security-alerts/cpuapr2022.html",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com/security-alerts/cpujul2022.html",
            },
         ],
         source: {
            advisory: "GHSA-h7v4-7xg3-hxcc",
            discovery: "UNKNOWN",
         },
         title: "XStream is vulnerable to an Arbitrary Code Execution attack",
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "security-advisories@github.com",
               ID: "CVE-2021-39147",
               STATE: "PUBLIC",
               TITLE: "XStream is vulnerable to an Arbitrary Code Execution attack",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "xstream",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "< 1.4.18 ",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "x-stream",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.",
                  },
               ],
            },
            impact: {
               cvss: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 8.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "LOW",
                  scope: "CHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
                  version: "3.1",
               },
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-434: Unrestricted Upload of File with Dangerous Type",
                        },
                     ],
                  },
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-502: Deserialization of Untrusted Data",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://github.com/x-stream/xstream/security/advisories/GHSA-h7v4-7xg3-hxcc",
                     refsource: "CONFIRM",
                     url: "https://github.com/x-stream/xstream/security/advisories/GHSA-h7v4-7xg3-hxcc",
                  },
                  {
                     name: "https://x-stream.github.io/CVE-2021-39147.html",
                     refsource: "MISC",
                     url: "https://x-stream.github.io/CVE-2021-39147.html",
                  },
                  {
                     name: "[debian-lts-announce] 20210929 [SECURITY] [DLA 2769-1] libxstream-java security update",
                     refsource: "MLIST",
                     url: "https://lists.debian.org/debian-lts-announce/2021/09/msg00017.html",
                  },
                  {
                     name: "FEDORA-2021-fbad11014a",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/",
                  },
                  {
                     name: "FEDORA-2021-d894ca87dc",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/",
                  },
                  {
                     name: "FEDORA-2021-5e376c0ed9",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/",
                  },
                  {
                     name: "DSA-5004",
                     refsource: "DEBIAN",
                     url: "https://www.debian.org/security/2021/dsa-5004",
                  },
                  {
                     name: "https://www.oracle.com/security-alerts/cpujan2022.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com/security-alerts/cpujan2022.html",
                  },
                  {
                     name: "https://security.netapp.com/advisory/ntap-20210923-0003/",
                     refsource: "CONFIRM",
                     url: "https://security.netapp.com/advisory/ntap-20210923-0003/",
                  },
                  {
                     name: "https://www.oracle.com/security-alerts/cpuapr2022.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com/security-alerts/cpuapr2022.html",
                  },
                  {
                     name: "https://www.oracle.com/security-alerts/cpujul2022.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com/security-alerts/cpujul2022.html",
                  },
               ],
            },
            source: {
               advisory: "GHSA-h7v4-7xg3-hxcc",
               discovery: "UNKNOWN",
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
      assignerShortName: "GitHub_M",
      cveId: "CVE-2021-39147",
      datePublished: "2021-08-23T18:05:33",
      dateReserved: "2021-08-16T00:00:00",
      dateUpdated: "2024-08-04T01:58:18.103Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2021-21341

Vulnerability from cvelistv5

Published

2021-03-22 23:40

Modified

2024-08-03 18:09

Severity ?

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Summary

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is vulnerability which may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a payload resulting in a denial of service only by manipulating the processed input stream. No user is affected who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.

References

▼	URL	Tags
	https://x-stream.github.io/security.html#workaround	x_refsource_MISC
	http://x-stream.github.io/changes.html#1.4.16	x_refsource_MISC
	https://github.com/x-stream/xstream/security/advisories/GHSA-2p3x-qw9c-25hh	x_refsource_CONFIRM
	https://x-stream.github.io/CVE-2021-21341.html	x_refsource_MISC
	https://lists.debian.org/debian-lts-announce/2021/04/msg00002.html	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fac48b425c6e16b0%40%3Cdev.jmeter.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae655414d23ed0dd%40%3Cusers.activemq.apache.org%3E	mailing-list, x_refsource_MLIST
	https://security.netapp.com/advisory/ntap-20210430-0002/	x_refsource_CONFIRM
	https://www.oracle.com//security-alerts/cpujul2021.html	x_refsource_MISC
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/	vendor-advisory, x_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/	vendor-advisory, x_refsource_FEDORA
	https://www.oracle.com/security-alerts/cpuoct2021.html	x_refsource_MISC
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/	vendor-advisory, x_refsource_FEDORA
	https://www.debian.org/security/2021/dsa-5004	vendor-advisory, x_refsource_DEBIAN
	https://www.oracle.com/security-alerts/cpujan2022.html	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	x-stream	xstream	Version: < 1.4.16

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T18:09:15.857Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://x-stream.github.io/security.html#workaround",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "http://x-stream.github.io/changes.html#1.4.16",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://github.com/x-stream/xstream/security/advisories/GHSA-2p3x-qw9c-25hh",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://x-stream.github.io/CVE-2021-21341.html",
               },
               {
                  name: "[debian-lts-announce] 20210403 [SECURITY] [DLA 2616-1] libxstream-java security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2021/04/msg00002.html",
               },
               {
                  name: "[jmeter-dev] 20210406 [GitHub] [jmeter] sseide opened a new pull request #655: update x-stream to 1.4.16 (from 1.4.15)",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fac48b425c6e16b0%40%3Cdev.jmeter.apache.org%3E",
               },
               {
                  name: "[activemq-users] 20210427 Release date for ActiveMQ v5.16.2 to fix CVEs",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae655414d23ed0dd%40%3Cusers.activemq.apache.org%3E",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20210430-0002/",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com//security-alerts/cpujul2021.html",
               },
               {
                  name: "FEDORA-2021-fbad11014a",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/",
               },
               {
                  name: "FEDORA-2021-d894ca87dc",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpuoct2021.html",
               },
               {
                  name: "FEDORA-2021-5e376c0ed9",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/",
               },
               {
                  name: "DSA-5004",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_DEBIAN",
                     "x_transferred",
                  ],
                  url: "https://www.debian.org/security/2021/dsa-5004",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpujan2022.html",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "xstream",
               vendor: "x-stream",
               versions: [
                  {
                     status: "affected",
                     version: "< 1.4.16",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is vulnerability which may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a payload resulting in a denial of service only by manipulating the processed input stream. No user is affected who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-400",
                     description: "CWE-400 Uncontrolled Resource Consumption",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
            {
               descriptions: [
                  {
                     cweId: "CWE-502",
                     description: "CWE-502 Deserialization of Untrusted Data",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-02-07T14:41:13",
            orgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
            shortName: "GitHub_M",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://x-stream.github.io/security.html#workaround",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "http://x-stream.github.io/changes.html#1.4.16",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://github.com/x-stream/xstream/security/advisories/GHSA-2p3x-qw9c-25hh",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://x-stream.github.io/CVE-2021-21341.html",
            },
            {
               name: "[debian-lts-announce] 20210403 [SECURITY] [DLA 2616-1] libxstream-java security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2021/04/msg00002.html",
            },
            {
               name: "[jmeter-dev] 20210406 [GitHub] [jmeter] sseide opened a new pull request #655: update x-stream to 1.4.16 (from 1.4.15)",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fac48b425c6e16b0%40%3Cdev.jmeter.apache.org%3E",
            },
            {
               name: "[activemq-users] 20210427 Release date for ActiveMQ v5.16.2 to fix CVEs",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae655414d23ed0dd%40%3Cusers.activemq.apache.org%3E",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://security.netapp.com/advisory/ntap-20210430-0002/",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com//security-alerts/cpujul2021.html",
            },
            {
               name: "FEDORA-2021-fbad11014a",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/",
            },
            {
               name: "FEDORA-2021-d894ca87dc",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com/security-alerts/cpuoct2021.html",
            },
            {
               name: "FEDORA-2021-5e376c0ed9",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/",
            },
            {
               name: "DSA-5004",
               tags: [
                  "vendor-advisory",
                  "x_refsource_DEBIAN",
               ],
               url: "https://www.debian.org/security/2021/dsa-5004",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com/security-alerts/cpujan2022.html",
            },
         ],
         source: {
            advisory: "GHSA-2p3x-qw9c-25hh",
            discovery: "UNKNOWN",
         },
         title: "XStream can cause a Denial of Service",
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "security-advisories@github.com",
               ID: "CVE-2021-21341",
               STATE: "PUBLIC",
               TITLE: "XStream can cause a Denial of Service",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "xstream",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "< 1.4.16",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "x-stream",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is vulnerability which may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a payload resulting in a denial of service only by manipulating the processed input stream. No user is affected who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.",
                  },
               ],
            },
            impact: {
               cvss: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-400 Uncontrolled Resource Consumption",
                        },
                     ],
                  },
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-502 Deserialization of Untrusted Data",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://x-stream.github.io/security.html#workaround",
                     refsource: "MISC",
                     url: "https://x-stream.github.io/security.html#workaround",
                  },
                  {
                     name: "http://x-stream.github.io/changes.html#1.4.16",
                     refsource: "MISC",
                     url: "http://x-stream.github.io/changes.html#1.4.16",
                  },
                  {
                     name: "https://github.com/x-stream/xstream/security/advisories/GHSA-2p3x-qw9c-25hh",
                     refsource: "CONFIRM",
                     url: "https://github.com/x-stream/xstream/security/advisories/GHSA-2p3x-qw9c-25hh",
                  },
                  {
                     name: "https://x-stream.github.io/CVE-2021-21341.html",
                     refsource: "MISC",
                     url: "https://x-stream.github.io/CVE-2021-21341.html",
                  },
                  {
                     name: "[debian-lts-announce] 20210403 [SECURITY] [DLA 2616-1] libxstream-java security update",
                     refsource: "MLIST",
                     url: "https://lists.debian.org/debian-lts-announce/2021/04/msg00002.html",
                  },
                  {
                     name: "[jmeter-dev] 20210406 [GitHub] [jmeter] sseide opened a new pull request #655: update x-stream to 1.4.16 (from 1.4.15)",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fac48b425c6e16b0@%3Cdev.jmeter.apache.org%3E",
                  },
                  {
                     name: "[activemq-users] 20210427 Release date for ActiveMQ v5.16.2 to fix CVEs",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae655414d23ed0dd@%3Cusers.activemq.apache.org%3E",
                  },
                  {
                     name: "https://security.netapp.com/advisory/ntap-20210430-0002/",
                     refsource: "CONFIRM",
                     url: "https://security.netapp.com/advisory/ntap-20210430-0002/",
                  },
                  {
                     name: "https://www.oracle.com//security-alerts/cpujul2021.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com//security-alerts/cpujul2021.html",
                  },
                  {
                     name: "FEDORA-2021-fbad11014a",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/",
                  },
                  {
                     name: "FEDORA-2021-d894ca87dc",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/",
                  },
                  {
                     name: "https://www.oracle.com/security-alerts/cpuoct2021.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com/security-alerts/cpuoct2021.html",
                  },
                  {
                     name: "FEDORA-2021-5e376c0ed9",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/",
                  },
                  {
                     name: "DSA-5004",
                     refsource: "DEBIAN",
                     url: "https://www.debian.org/security/2021/dsa-5004",
                  },
                  {
                     name: "https://www.oracle.com/security-alerts/cpujan2022.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com/security-alerts/cpujan2022.html",
                  },
               ],
            },
            source: {
               advisory: "GHSA-2p3x-qw9c-25hh",
               discovery: "UNKNOWN",
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
      assignerShortName: "GitHub_M",
      cveId: "CVE-2021-21341",
      datePublished: "2021-03-22T23:40:44",
      dateReserved: "2020-12-22T00:00:00",
      dateUpdated: "2024-08-03T18:09:15.857Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2017-7957

Vulnerability from cvelistv5

Published

2017-04-29 19:00

Modified

2024-08-05 16:19

Severity ?

Summary

XStream through 1.4.9, when a certain denyTypes workaround is not used, mishandles attempts to create an instance of the primitive type 'void' during unmarshalling, leading to a remote application crash, as demonstrated by an xstream.fromXML("<void/>") call.

References

▼	URL	Tags
	https://access.redhat.com/errata/RHSA-2017:2888	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2017:1832	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2017:2889	vendor-advisory, x_refsource_REDHAT
	http://www.securitytracker.com/id/1039499	vdb-entry, x_refsource_SECTRACK
	https://www-prd-trops.events.ibm.com/node/715749	x_refsource_CONFIRM
	https://exchange.xforce.ibmcloud.com/vulnerabilities/125800	vdb-entry, x_refsource_XF
	http://www.debian.org/security/2017/dsa-3841	vendor-advisory, x_refsource_DEBIAN
	http://x-stream.github.io/CVE-2017-7957.html	x_refsource_CONFIRM
	http://www.securityfocus.com/bid/100687	vdb-entry, x_refsource_BID

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-05T16:19:29.479Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "RHSA-2017:2888",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2017:2888",
               },
               {
                  name: "RHSA-2017:1832",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2017:1832",
               },
               {
                  name: "RHSA-2017:2889",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2017:2889",
               },
               {
                  name: "1039499",
                  tags: [
                     "vdb-entry",
                     "x_refsource_SECTRACK",
                     "x_transferred",
                  ],
                  url: "http://www.securitytracker.com/id/1039499",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://www-prd-trops.events.ibm.com/node/715749",
               },
               {
                  name: "xstream-cve20177957-dos(125800)",
                  tags: [
                     "vdb-entry",
                     "x_refsource_XF",
                     "x_transferred",
                  ],
                  url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/125800",
               },
               {
                  name: "DSA-3841",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_DEBIAN",
                     "x_transferred",
                  ],
                  url: "http://www.debian.org/security/2017/dsa-3841",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "http://x-stream.github.io/CVE-2017-7957.html",
               },
               {
                  name: "100687",
                  tags: [
                     "vdb-entry",
                     "x_refsource_BID",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/bid/100687",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         datePublic: "2017-04-29T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "XStream through 1.4.9, when a certain denyTypes workaround is not used, mishandles attempts to create an instance of the primitive type 'void' during unmarshalling, leading to a remote application crash, as demonstrated by an xstream.fromXML(\"<void/>\") call.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2018-07-05T17:57:01",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               name: "RHSA-2017:2888",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2017:2888",
            },
            {
               name: "RHSA-2017:1832",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2017:1832",
            },
            {
               name: "RHSA-2017:2889",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2017:2889",
            },
            {
               name: "1039499",
               tags: [
                  "vdb-entry",
                  "x_refsource_SECTRACK",
               ],
               url: "http://www.securitytracker.com/id/1039499",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://www-prd-trops.events.ibm.com/node/715749",
            },
            {
               name: "xstream-cve20177957-dos(125800)",
               tags: [
                  "vdb-entry",
                  "x_refsource_XF",
               ],
               url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/125800",
            },
            {
               name: "DSA-3841",
               tags: [
                  "vendor-advisory",
                  "x_refsource_DEBIAN",
               ],
               url: "http://www.debian.org/security/2017/dsa-3841",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "http://x-stream.github.io/CVE-2017-7957.html",
            },
            {
               name: "100687",
               tags: [
                  "vdb-entry",
                  "x_refsource_BID",
               ],
               url: "http://www.securityfocus.com/bid/100687",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "cve@mitre.org",
               ID: "CVE-2017-7957",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "n/a",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "n/a",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "XStream through 1.4.9, when a certain denyTypes workaround is not used, mishandles attempts to create an instance of the primitive type 'void' during unmarshalling, leading to a remote application crash, as demonstrated by an xstream.fromXML(\"<void/>\") call.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "n/a",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "RHSA-2017:2888",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2017:2888",
                  },
                  {
                     name: "RHSA-2017:1832",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2017:1832",
                  },
                  {
                     name: "RHSA-2017:2889",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2017:2889",
                  },
                  {
                     name: "1039499",
                     refsource: "SECTRACK",
                     url: "http://www.securitytracker.com/id/1039499",
                  },
                  {
                     name: "https://www-prd-trops.events.ibm.com/node/715749",
                     refsource: "CONFIRM",
                     url: "https://www-prd-trops.events.ibm.com/node/715749",
                  },
                  {
                     name: "xstream-cve20177957-dos(125800)",
                     refsource: "XF",
                     url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/125800",
                  },
                  {
                     name: "DSA-3841",
                     refsource: "DEBIAN",
                     url: "http://www.debian.org/security/2017/dsa-3841",
                  },
                  {
                     name: "http://x-stream.github.io/CVE-2017-7957.html",
                     refsource: "CONFIRM",
                     url: "http://x-stream.github.io/CVE-2017-7957.html",
                  },
                  {
                     name: "100687",
                     refsource: "BID",
                     url: "http://www.securityfocus.com/bid/100687",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2017-7957",
      datePublished: "2017-04-29T19:00:00",
      dateReserved: "2017-04-19T00:00:00",
      dateUpdated: "2024-08-05T16:19:29.479Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2021-21346

Vulnerability from cvelistv5

Published

2021-03-22 23:40

Modified

2024-08-03 18:09

Severity ?

6.1 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N

Summary

References

▼	URL	Tags
	https://x-stream.github.io/security.html#workaround	x_refsource_MISC
	http://x-stream.github.io/changes.html#1.4.16	x_refsource_MISC
	https://github.com/x-stream/xstream/security/advisories/GHSA-4hrm-m67v-5cxr	x_refsource_CONFIRM
	https://x-stream.github.io/CVE-2021-21346.html	x_refsource_MISC
	https://lists.debian.org/debian-lts-announce/2021/04/msg00002.html	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fac48b425c6e16b0%40%3Cdev.jmeter.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae655414d23ed0dd%40%3Cusers.activemq.apache.org%3E	mailing-list, x_refsource_MLIST
	https://security.netapp.com/advisory/ntap-20210430-0002/	x_refsource_CONFIRM
	https://www.oracle.com//security-alerts/cpujul2021.html	x_refsource_MISC
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/	vendor-advisory, x_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/	vendor-advisory, x_refsource_FEDORA
	https://www.oracle.com/security-alerts/cpuoct2021.html	x_refsource_MISC
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/	vendor-advisory, x_refsource_FEDORA
	https://www.debian.org/security/2021/dsa-5004	vendor-advisory, x_refsource_DEBIAN
	https://www.oracle.com/security-alerts/cpujan2022.html	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	x-stream	xstream	Version: < 1.4.16

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T18:09:15.764Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://x-stream.github.io/security.html#workaround",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "http://x-stream.github.io/changes.html#1.4.16",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://github.com/x-stream/xstream/security/advisories/GHSA-4hrm-m67v-5cxr",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://x-stream.github.io/CVE-2021-21346.html",
               },
               {
                  name: "[debian-lts-announce] 20210403 [SECURITY] [DLA 2616-1] libxstream-java security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2021/04/msg00002.html",
               },
               {
                  name: "[jmeter-dev] 20210406 [GitHub] [jmeter] sseide opened a new pull request #655: update x-stream to 1.4.16 (from 1.4.15)",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fac48b425c6e16b0%40%3Cdev.jmeter.apache.org%3E",
               },
               {
                  name: "[activemq-users] 20210427 Release date for ActiveMQ v5.16.2 to fix CVEs",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae655414d23ed0dd%40%3Cusers.activemq.apache.org%3E",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20210430-0002/",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com//security-alerts/cpujul2021.html",
               },
               {
                  name: "FEDORA-2021-fbad11014a",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/",
               },
               {
                  name: "FEDORA-2021-d894ca87dc",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpuoct2021.html",
               },
               {
                  name: "FEDORA-2021-5e376c0ed9",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/",
               },
               {
                  name: "DSA-5004",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_DEBIAN",
                     "x_transferred",
                  ],
                  url: "https://www.debian.org/security/2021/dsa-5004",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpujan2022.html",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "xstream",
               vendor: "x-stream",
               versions: [
                  {
                     status: "affected",
                     version: "< 1.4.16",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 6.1,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "NONE",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "CHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-434",
                     description: "CWE-434 Unrestricted Upload of File with Dangerous Type",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
            {
               descriptions: [
                  {
                     cweId: "CWE-502",
                     description: "CWE-502 Deserialization of Untrusted Data",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-02-07T14:41:18",
            orgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
            shortName: "GitHub_M",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://x-stream.github.io/security.html#workaround",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "http://x-stream.github.io/changes.html#1.4.16",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://github.com/x-stream/xstream/security/advisories/GHSA-4hrm-m67v-5cxr",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://x-stream.github.io/CVE-2021-21346.html",
            },
            {
               name: "[debian-lts-announce] 20210403 [SECURITY] [DLA 2616-1] libxstream-java security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2021/04/msg00002.html",
            },
            {
               name: "[jmeter-dev] 20210406 [GitHub] [jmeter] sseide opened a new pull request #655: update x-stream to 1.4.16 (from 1.4.15)",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fac48b425c6e16b0%40%3Cdev.jmeter.apache.org%3E",
            },
            {
               name: "[activemq-users] 20210427 Release date for ActiveMQ v5.16.2 to fix CVEs",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae655414d23ed0dd%40%3Cusers.activemq.apache.org%3E",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://security.netapp.com/advisory/ntap-20210430-0002/",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com//security-alerts/cpujul2021.html",
            },
            {
               name: "FEDORA-2021-fbad11014a",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/",
            },
            {
               name: "FEDORA-2021-d894ca87dc",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com/security-alerts/cpuoct2021.html",
            },
            {
               name: "FEDORA-2021-5e376c0ed9",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/",
            },
            {
               name: "DSA-5004",
               tags: [
                  "vendor-advisory",
                  "x_refsource_DEBIAN",
               ],
               url: "https://www.debian.org/security/2021/dsa-5004",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com/security-alerts/cpujan2022.html",
            },
         ],
         source: {
            advisory: "GHSA-4hrm-m67v-5cxr",
            discovery: "UNKNOWN",
         },
         title: "XStream is vulnerable to an Arbitrary Code Execution attack",
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "security-advisories@github.com",
               ID: "CVE-2021-21346",
               STATE: "PUBLIC",
               TITLE: "XStream is vulnerable to an Arbitrary Code Execution attack",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "xstream",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "< 1.4.16",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "x-stream",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.",
                  },
               ],
            },
            impact: {
               cvss: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 6.1,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "NONE",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "CHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N",
                  version: "3.1",
               },
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-434 Unrestricted Upload of File with Dangerous Type",
                        },
                     ],
                  },
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-502 Deserialization of Untrusted Data",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://x-stream.github.io/security.html#workaround",
                     refsource: "MISC",
                     url: "https://x-stream.github.io/security.html#workaround",
                  },
                  {
                     name: "http://x-stream.github.io/changes.html#1.4.16",
                     refsource: "MISC",
                     url: "http://x-stream.github.io/changes.html#1.4.16",
                  },
                  {
                     name: "https://github.com/x-stream/xstream/security/advisories/GHSA-4hrm-m67v-5cxr",
                     refsource: "CONFIRM",
                     url: "https://github.com/x-stream/xstream/security/advisories/GHSA-4hrm-m67v-5cxr",
                  },
                  {
                     name: "https://x-stream.github.io/CVE-2021-21346.html",
                     refsource: "MISC",
                     url: "https://x-stream.github.io/CVE-2021-21346.html",
                  },
                  {
                     name: "[debian-lts-announce] 20210403 [SECURITY] [DLA 2616-1] libxstream-java security update",
                     refsource: "MLIST",
                     url: "https://lists.debian.org/debian-lts-announce/2021/04/msg00002.html",
                  },
                  {
                     name: "[jmeter-dev] 20210406 [GitHub] [jmeter] sseide opened a new pull request #655: update x-stream to 1.4.16 (from 1.4.15)",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fac48b425c6e16b0@%3Cdev.jmeter.apache.org%3E",
                  },
                  {
                     name: "[activemq-users] 20210427 Release date for ActiveMQ v5.16.2 to fix CVEs",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae655414d23ed0dd@%3Cusers.activemq.apache.org%3E",
                  },
                  {
                     name: "https://security.netapp.com/advisory/ntap-20210430-0002/",
                     refsource: "CONFIRM",
                     url: "https://security.netapp.com/advisory/ntap-20210430-0002/",
                  },
                  {
                     name: "https://www.oracle.com//security-alerts/cpujul2021.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com//security-alerts/cpujul2021.html",
                  },
                  {
                     name: "FEDORA-2021-fbad11014a",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/",
                  },
                  {
                     name: "FEDORA-2021-d894ca87dc",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/",
                  },
                  {
                     name: "https://www.oracle.com/security-alerts/cpuoct2021.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com/security-alerts/cpuoct2021.html",
                  },
                  {
                     name: "FEDORA-2021-5e376c0ed9",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/",
                  },
                  {
                     name: "DSA-5004",
                     refsource: "DEBIAN",
                     url: "https://www.debian.org/security/2021/dsa-5004",
                  },
                  {
                     name: "https://www.oracle.com/security-alerts/cpujan2022.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com/security-alerts/cpujan2022.html",
                  },
               ],
            },
            source: {
               advisory: "GHSA-4hrm-m67v-5cxr",
               discovery: "UNKNOWN",
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
      assignerShortName: "GitHub_M",
      cveId: "CVE-2021-21346",
      datePublished: "2021-03-22T23:40:20",
      dateReserved: "2020-12-22T00:00:00",
      dateUpdated: "2024-08-03T18:09:15.764Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2021-21342

Vulnerability from cvelistv5

Published

2021-03-22 23:40

Modified

2024-08-03 18:09

Severity ?

5.3 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N

Summary

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability where the processed stream at unmarshalling time contains type information to recreate the formerly written objects. XStream creates therefore new instances based on these type information. An attacker can manipulate the processed input stream and replace or inject objects, that result in a server-side forgery request. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.

References

▼	URL	Tags
	https://x-stream.github.io/security.html#workaround	x_refsource_MISC
	http://x-stream.github.io/changes.html#1.4.16	x_refsource_MISC
	https://github.com/x-stream/xstream/security/advisories/GHSA-hvv8-336g-rx3m	x_refsource_CONFIRM
	https://x-stream.github.io/CVE-2021-21342.html	x_refsource_MISC
	https://lists.debian.org/debian-lts-announce/2021/04/msg00002.html	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fac48b425c6e16b0%40%3Cdev.jmeter.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae655414d23ed0dd%40%3Cusers.activemq.apache.org%3E	mailing-list, x_refsource_MLIST
	https://security.netapp.com/advisory/ntap-20210430-0002/	x_refsource_CONFIRM
	https://www.oracle.com//security-alerts/cpujul2021.html	x_refsource_MISC
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/	vendor-advisory, x_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/	vendor-advisory, x_refsource_FEDORA
	https://www.oracle.com/security-alerts/cpuoct2021.html	x_refsource_MISC
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/	vendor-advisory, x_refsource_FEDORA
	https://www.debian.org/security/2021/dsa-5004	vendor-advisory, x_refsource_DEBIAN
	https://www.oracle.com/security-alerts/cpujan2022.html	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	x-stream	xstream	Version: < 1.4.16

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T18:09:15.862Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://x-stream.github.io/security.html#workaround",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "http://x-stream.github.io/changes.html#1.4.16",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://github.com/x-stream/xstream/security/advisories/GHSA-hvv8-336g-rx3m",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://x-stream.github.io/CVE-2021-21342.html",
               },
               {
                  name: "[debian-lts-announce] 20210403 [SECURITY] [DLA 2616-1] libxstream-java security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2021/04/msg00002.html",
               },
               {
                  name: "[jmeter-dev] 20210406 [GitHub] [jmeter] sseide opened a new pull request #655: update x-stream to 1.4.16 (from 1.4.15)",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fac48b425c6e16b0%40%3Cdev.jmeter.apache.org%3E",
               },
               {
                  name: "[activemq-users] 20210427 Release date for ActiveMQ v5.16.2 to fix CVEs",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae655414d23ed0dd%40%3Cusers.activemq.apache.org%3E",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20210430-0002/",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com//security-alerts/cpujul2021.html",
               },
               {
                  name: "FEDORA-2021-fbad11014a",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/",
               },
               {
                  name: "FEDORA-2021-d894ca87dc",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpuoct2021.html",
               },
               {
                  name: "FEDORA-2021-5e376c0ed9",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/",
               },
               {
                  name: "DSA-5004",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_DEBIAN",
                     "x_transferred",
                  ],
                  url: "https://www.debian.org/security/2021/dsa-5004",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpujan2022.html",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "xstream",
               vendor: "x-stream",
               versions: [
                  {
                     status: "affected",
                     version: "< 1.4.16",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability where the processed stream at unmarshalling time contains type information to recreate the formerly written objects. XStream creates therefore new instances based on these type information. An attacker can manipulate the processed input stream and replace or inject objects, that result in a server-side forgery request. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 5.3,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "NONE",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-502",
                     description: "CWE-502 Deserialization of Untrusted Data",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
            {
               descriptions: [
                  {
                     cweId: "CWE-918",
                     description: "CWE-918 Server-Side Request Forgery (SSRF)",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-02-07T14:41:14",
            orgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
            shortName: "GitHub_M",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://x-stream.github.io/security.html#workaround",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "http://x-stream.github.io/changes.html#1.4.16",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://github.com/x-stream/xstream/security/advisories/GHSA-hvv8-336g-rx3m",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://x-stream.github.io/CVE-2021-21342.html",
            },
            {
               name: "[debian-lts-announce] 20210403 [SECURITY] [DLA 2616-1] libxstream-java security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2021/04/msg00002.html",
            },
            {
               name: "[jmeter-dev] 20210406 [GitHub] [jmeter] sseide opened a new pull request #655: update x-stream to 1.4.16 (from 1.4.15)",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fac48b425c6e16b0%40%3Cdev.jmeter.apache.org%3E",
            },
            {
               name: "[activemq-users] 20210427 Release date for ActiveMQ v5.16.2 to fix CVEs",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae655414d23ed0dd%40%3Cusers.activemq.apache.org%3E",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://security.netapp.com/advisory/ntap-20210430-0002/",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com//security-alerts/cpujul2021.html",
            },
            {
               name: "FEDORA-2021-fbad11014a",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/",
            },
            {
               name: "FEDORA-2021-d894ca87dc",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com/security-alerts/cpuoct2021.html",
            },
            {
               name: "FEDORA-2021-5e376c0ed9",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/",
            },
            {
               name: "DSA-5004",
               tags: [
                  "vendor-advisory",
                  "x_refsource_DEBIAN",
               ],
               url: "https://www.debian.org/security/2021/dsa-5004",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com/security-alerts/cpujan2022.html",
            },
         ],
         source: {
            advisory: "GHSA-hvv8-336g-rx3m",
            discovery: "UNKNOWN",
         },
         title: "A Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host",
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "security-advisories@github.com",
               ID: "CVE-2021-21342",
               STATE: "PUBLIC",
               TITLE: "A Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "xstream",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "< 1.4.16",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "x-stream",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability where the processed stream at unmarshalling time contains type information to recreate the formerly written objects. XStream creates therefore new instances based on these type information. An attacker can manipulate the processed input stream and replace or inject objects, that result in a server-side forgery request. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.",
                  },
               ],
            },
            impact: {
               cvss: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 5.3,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "NONE",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N",
                  version: "3.1",
               },
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-502 Deserialization of Untrusted Data",
                        },
                     ],
                  },
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-918 Server-Side Request Forgery (SSRF)",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://x-stream.github.io/security.html#workaround",
                     refsource: "MISC",
                     url: "https://x-stream.github.io/security.html#workaround",
                  },
                  {
                     name: "http://x-stream.github.io/changes.html#1.4.16",
                     refsource: "MISC",
                     url: "http://x-stream.github.io/changes.html#1.4.16",
                  },
                  {
                     name: "https://github.com/x-stream/xstream/security/advisories/GHSA-hvv8-336g-rx3m",
                     refsource: "CONFIRM",
                     url: "https://github.com/x-stream/xstream/security/advisories/GHSA-hvv8-336g-rx3m",
                  },
                  {
                     name: "https://x-stream.github.io/CVE-2021-21342.html",
                     refsource: "MISC",
                     url: "https://x-stream.github.io/CVE-2021-21342.html",
                  },
                  {
                     name: "[debian-lts-announce] 20210403 [SECURITY] [DLA 2616-1] libxstream-java security update",
                     refsource: "MLIST",
                     url: "https://lists.debian.org/debian-lts-announce/2021/04/msg00002.html",
                  },
                  {
                     name: "[jmeter-dev] 20210406 [GitHub] [jmeter] sseide opened a new pull request #655: update x-stream to 1.4.16 (from 1.4.15)",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fac48b425c6e16b0@%3Cdev.jmeter.apache.org%3E",
                  },
                  {
                     name: "[activemq-users] 20210427 Release date for ActiveMQ v5.16.2 to fix CVEs",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae655414d23ed0dd@%3Cusers.activemq.apache.org%3E",
                  },
                  {
                     name: "https://security.netapp.com/advisory/ntap-20210430-0002/",
                     refsource: "CONFIRM",
                     url: "https://security.netapp.com/advisory/ntap-20210430-0002/",
                  },
                  {
                     name: "https://www.oracle.com//security-alerts/cpujul2021.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com//security-alerts/cpujul2021.html",
                  },
                  {
                     name: "FEDORA-2021-fbad11014a",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/",
                  },
                  {
                     name: "FEDORA-2021-d894ca87dc",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/",
                  },
                  {
                     name: "https://www.oracle.com/security-alerts/cpuoct2021.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com/security-alerts/cpuoct2021.html",
                  },
                  {
                     name: "FEDORA-2021-5e376c0ed9",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/",
                  },
                  {
                     name: "DSA-5004",
                     refsource: "DEBIAN",
                     url: "https://www.debian.org/security/2021/dsa-5004",
                  },
                  {
                     name: "https://www.oracle.com/security-alerts/cpujan2022.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com/security-alerts/cpujan2022.html",
                  },
               ],
            },
            source: {
               advisory: "GHSA-hvv8-336g-rx3m",
               discovery: "UNKNOWN",
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
      assignerShortName: "GitHub_M",
      cveId: "CVE-2021-21342",
      datePublished: "2021-03-22T23:40:39",
      dateReserved: "2020-12-22T00:00:00",
      dateUpdated: "2024-08-03T18:09:15.862Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2021-39153

Vulnerability from cvelistv5

Published

2021-08-23 17:55

Modified

2024-08-04 01:58

Severity ?

8.5 (High) - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Summary

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream, if using the version out of the box with Java runtime version 14 to 8 or with JavaFX installed. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.

References

▼	URL	Tags
	https://github.com/x-stream/xstream/security/advisories/GHSA-2q8x-2p7f-574v	x_refsource_CONFIRM
	https://x-stream.github.io/CVE-2021-39153.html	x_refsource_MISC
	https://lists.debian.org/debian-lts-announce/2021/09/msg00017.html	mailing-list, x_refsource_MLIST
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/	vendor-advisory, x_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/	vendor-advisory, x_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/	vendor-advisory, x_refsource_FEDORA
	https://www.debian.org/security/2021/dsa-5004	vendor-advisory, x_refsource_DEBIAN
	https://www.oracle.com/security-alerts/cpujan2022.html	x_refsource_MISC
	https://security.netapp.com/advisory/ntap-20210923-0003/	x_refsource_CONFIRM
	https://www.oracle.com/security-alerts/cpuapr2022.html	x_refsource_MISC
	https://www.oracle.com/security-alerts/cpujul2022.html	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	x-stream	xstream	Version: < 1.4.18

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T01:58:18.194Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://github.com/x-stream/xstream/security/advisories/GHSA-2q8x-2p7f-574v",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://x-stream.github.io/CVE-2021-39153.html",
               },
               {
                  name: "[debian-lts-announce] 20210929 [SECURITY] [DLA 2769-1] libxstream-java security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2021/09/msg00017.html",
               },
               {
                  name: "FEDORA-2021-fbad11014a",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/",
               },
               {
                  name: "FEDORA-2021-d894ca87dc",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/",
               },
               {
                  name: "FEDORA-2021-5e376c0ed9",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/",
               },
               {
                  name: "DSA-5004",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_DEBIAN",
                     "x_transferred",
                  ],
                  url: "https://www.debian.org/security/2021/dsa-5004",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpujan2022.html",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20210923-0003/",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpuapr2022.html",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpujul2022.html",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "xstream",
               vendor: "x-stream",
               versions: [
                  {
                     status: "affected",
                     version: "< 1.4.18 ",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream, if using the version out of the box with Java runtime version 14 to 8 or with JavaFX installed. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 8.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "LOW",
                  scope: "CHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-434",
                     description: "CWE-434: Unrestricted Upload of File with Dangerous Type",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
            {
               descriptions: [
                  {
                     cweId: "CWE-502",
                     description: "CWE-502: Deserialization of Untrusted Data",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-07-25T16:34:16",
            orgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
            shortName: "GitHub_M",
         },
         references: [
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://github.com/x-stream/xstream/security/advisories/GHSA-2q8x-2p7f-574v",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://x-stream.github.io/CVE-2021-39153.html",
            },
            {
               name: "[debian-lts-announce] 20210929 [SECURITY] [DLA 2769-1] libxstream-java security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2021/09/msg00017.html",
            },
            {
               name: "FEDORA-2021-fbad11014a",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/",
            },
            {
               name: "FEDORA-2021-d894ca87dc",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/",
            },
            {
               name: "FEDORA-2021-5e376c0ed9",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/",
            },
            {
               name: "DSA-5004",
               tags: [
                  "vendor-advisory",
                  "x_refsource_DEBIAN",
               ],
               url: "https://www.debian.org/security/2021/dsa-5004",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com/security-alerts/cpujan2022.html",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://security.netapp.com/advisory/ntap-20210923-0003/",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com/security-alerts/cpuapr2022.html",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com/security-alerts/cpujul2022.html",
            },
         ],
         source: {
            advisory: "GHSA-2q8x-2p7f-574v",
            discovery: "UNKNOWN",
         },
         title: "XStream is vulnerable to an Arbitrary Code Execution attack",
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "security-advisories@github.com",
               ID: "CVE-2021-39153",
               STATE: "PUBLIC",
               TITLE: "XStream is vulnerable to an Arbitrary Code Execution attack",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "xstream",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "< 1.4.18 ",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "x-stream",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream, if using the version out of the box with Java runtime version 14 to 8 or with JavaFX installed. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.",
                  },
               ],
            },
            impact: {
               cvss: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 8.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "LOW",
                  scope: "CHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
                  version: "3.1",
               },
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-434: Unrestricted Upload of File with Dangerous Type",
                        },
                     ],
                  },
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-502: Deserialization of Untrusted Data",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://github.com/x-stream/xstream/security/advisories/GHSA-2q8x-2p7f-574v",
                     refsource: "CONFIRM",
                     url: "https://github.com/x-stream/xstream/security/advisories/GHSA-2q8x-2p7f-574v",
                  },
                  {
                     name: "https://x-stream.github.io/CVE-2021-39153.html",
                     refsource: "MISC",
                     url: "https://x-stream.github.io/CVE-2021-39153.html",
                  },
                  {
                     name: "[debian-lts-announce] 20210929 [SECURITY] [DLA 2769-1] libxstream-java security update",
                     refsource: "MLIST",
                     url: "https://lists.debian.org/debian-lts-announce/2021/09/msg00017.html",
                  },
                  {
                     name: "FEDORA-2021-fbad11014a",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/",
                  },
                  {
                     name: "FEDORA-2021-d894ca87dc",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/",
                  },
                  {
                     name: "FEDORA-2021-5e376c0ed9",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/",
                  },
                  {
                     name: "DSA-5004",
                     refsource: "DEBIAN",
                     url: "https://www.debian.org/security/2021/dsa-5004",
                  },
                  {
                     name: "https://www.oracle.com/security-alerts/cpujan2022.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com/security-alerts/cpujan2022.html",
                  },
                  {
                     name: "https://security.netapp.com/advisory/ntap-20210923-0003/",
                     refsource: "CONFIRM",
                     url: "https://security.netapp.com/advisory/ntap-20210923-0003/",
                  },
                  {
                     name: "https://www.oracle.com/security-alerts/cpuapr2022.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com/security-alerts/cpuapr2022.html",
                  },
                  {
                     name: "https://www.oracle.com/security-alerts/cpujul2022.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com/security-alerts/cpujul2022.html",
                  },
               ],
            },
            source: {
               advisory: "GHSA-2q8x-2p7f-574v",
               discovery: "UNKNOWN",
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
      assignerShortName: "GitHub_M",
      cveId: "CVE-2021-39153",
      datePublished: "2021-08-23T17:55:14",
      dateReserved: "2021-08-16T00:00:00",
      dateUpdated: "2024-08-04T01:58:18.194Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2021-21349

Vulnerability from cvelistv5

Published

2021-03-22 23:45

Modified

2024-08-03 18:09

Severity ?

6.1 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N

Summary

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.

References

▼	URL	Tags
	https://x-stream.github.io/security.html#workaround	x_refsource_MISC
	http://x-stream.github.io/changes.html#1.4.16	x_refsource_MISC
	https://github.com/x-stream/xstream/security/advisories/GHSA-f6hm-88x3-mfjv	x_refsource_CONFIRM
	https://x-stream.github.io/CVE-2021-21349.html	x_refsource_MISC
	https://lists.debian.org/debian-lts-announce/2021/04/msg00002.html	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fac48b425c6e16b0%40%3Cdev.jmeter.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae655414d23ed0dd%40%3Cusers.activemq.apache.org%3E	mailing-list, x_refsource_MLIST
	https://security.netapp.com/advisory/ntap-20210430-0002/	x_refsource_CONFIRM
	https://www.oracle.com//security-alerts/cpujul2021.html	x_refsource_MISC
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/	vendor-advisory, x_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/	vendor-advisory, x_refsource_FEDORA
	https://www.oracle.com/security-alerts/cpuoct2021.html	x_refsource_MISC
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/	vendor-advisory, x_refsource_FEDORA
	https://www.debian.org/security/2021/dsa-5004	vendor-advisory, x_refsource_DEBIAN
	https://www.oracle.com/security-alerts/cpujan2022.html	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	x-stream	xstream	Version: < 1.4.16

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T18:09:15.735Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://x-stream.github.io/security.html#workaround",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "http://x-stream.github.io/changes.html#1.4.16",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://github.com/x-stream/xstream/security/advisories/GHSA-f6hm-88x3-mfjv",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://x-stream.github.io/CVE-2021-21349.html",
               },
               {
                  name: "[debian-lts-announce] 20210403 [SECURITY] [DLA 2616-1] libxstream-java security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2021/04/msg00002.html",
               },
               {
                  name: "[jmeter-dev] 20210406 [GitHub] [jmeter] sseide opened a new pull request #655: update x-stream to 1.4.16 (from 1.4.15)",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fac48b425c6e16b0%40%3Cdev.jmeter.apache.org%3E",
               },
               {
                  name: "[activemq-users] 20210427 Release date for ActiveMQ v5.16.2 to fix CVEs",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae655414d23ed0dd%40%3Cusers.activemq.apache.org%3E",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20210430-0002/",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com//security-alerts/cpujul2021.html",
               },
               {
                  name: "FEDORA-2021-fbad11014a",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/",
               },
               {
                  name: "FEDORA-2021-d894ca87dc",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpuoct2021.html",
               },
               {
                  name: "FEDORA-2021-5e376c0ed9",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/",
               },
               {
                  name: "DSA-5004",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_DEBIAN",
                     "x_transferred",
                  ],
                  url: "https://www.debian.org/security/2021/dsa-5004",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpujan2022.html",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "xstream",
               vendor: "x-stream",
               versions: [
                  {
                     status: "affected",
                     version: "< 1.4.16",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 6.1,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "NONE",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "CHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-502",
                     description: "CWE-502 Deserialization of Untrusted Data",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
            {
               descriptions: [
                  {
                     cweId: "CWE-918",
                     description: "CWE-918 Server-Side Request Forgery (SSRF)",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-02-07T14:41:21",
            orgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
            shortName: "GitHub_M",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://x-stream.github.io/security.html#workaround",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "http://x-stream.github.io/changes.html#1.4.16",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://github.com/x-stream/xstream/security/advisories/GHSA-f6hm-88x3-mfjv",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://x-stream.github.io/CVE-2021-21349.html",
            },
            {
               name: "[debian-lts-announce] 20210403 [SECURITY] [DLA 2616-1] libxstream-java security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2021/04/msg00002.html",
            },
            {
               name: "[jmeter-dev] 20210406 [GitHub] [jmeter] sseide opened a new pull request #655: update x-stream to 1.4.16 (from 1.4.15)",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fac48b425c6e16b0%40%3Cdev.jmeter.apache.org%3E",
            },
            {
               name: "[activemq-users] 20210427 Release date for ActiveMQ v5.16.2 to fix CVEs",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae655414d23ed0dd%40%3Cusers.activemq.apache.org%3E",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://security.netapp.com/advisory/ntap-20210430-0002/",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com//security-alerts/cpujul2021.html",
            },
            {
               name: "FEDORA-2021-fbad11014a",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/",
            },
            {
               name: "FEDORA-2021-d894ca87dc",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com/security-alerts/cpuoct2021.html",
            },
            {
               name: "FEDORA-2021-5e376c0ed9",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/",
            },
            {
               name: "DSA-5004",
               tags: [
                  "vendor-advisory",
                  "x_refsource_DEBIAN",
               ],
               url: "https://www.debian.org/security/2021/dsa-5004",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com/security-alerts/cpujan2022.html",
            },
         ],
         source: {
            advisory: "GHSA-f6hm-88x3-mfjv",
            discovery: "UNKNOWN",
         },
         title: "A Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host",
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "security-advisories@github.com",
               ID: "CVE-2021-21349",
               STATE: "PUBLIC",
               TITLE: "A Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "xstream",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "< 1.4.16",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "x-stream",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.",
                  },
               ],
            },
            impact: {
               cvss: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 6.1,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "NONE",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "CHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N",
                  version: "3.1",
               },
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-502 Deserialization of Untrusted Data",
                        },
                     ],
                  },
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-918 Server-Side Request Forgery (SSRF)",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://x-stream.github.io/security.html#workaround",
                     refsource: "MISC",
                     url: "https://x-stream.github.io/security.html#workaround",
                  },
                  {
                     name: "http://x-stream.github.io/changes.html#1.4.16",
                     refsource: "MISC",
                     url: "http://x-stream.github.io/changes.html#1.4.16",
                  },
                  {
                     name: "https://github.com/x-stream/xstream/security/advisories/GHSA-f6hm-88x3-mfjv",
                     refsource: "CONFIRM",
                     url: "https://github.com/x-stream/xstream/security/advisories/GHSA-f6hm-88x3-mfjv",
                  },
                  {
                     name: "https://x-stream.github.io/CVE-2021-21349.html",
                     refsource: "MISC",
                     url: "https://x-stream.github.io/CVE-2021-21349.html",
                  },
                  {
                     name: "[debian-lts-announce] 20210403 [SECURITY] [DLA 2616-1] libxstream-java security update",
                     refsource: "MLIST",
                     url: "https://lists.debian.org/debian-lts-announce/2021/04/msg00002.html",
                  },
                  {
                     name: "[jmeter-dev] 20210406 [GitHub] [jmeter] sseide opened a new pull request #655: update x-stream to 1.4.16 (from 1.4.15)",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fac48b425c6e16b0@%3Cdev.jmeter.apache.org%3E",
                  },
                  {
                     name: "[activemq-users] 20210427 Release date for ActiveMQ v5.16.2 to fix CVEs",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae655414d23ed0dd@%3Cusers.activemq.apache.org%3E",
                  },
                  {
                     name: "https://security.netapp.com/advisory/ntap-20210430-0002/",
                     refsource: "CONFIRM",
                     url: "https://security.netapp.com/advisory/ntap-20210430-0002/",
                  },
                  {
                     name: "https://www.oracle.com//security-alerts/cpujul2021.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com//security-alerts/cpujul2021.html",
                  },
                  {
                     name: "FEDORA-2021-fbad11014a",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/",
                  },
                  {
                     name: "FEDORA-2021-d894ca87dc",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/",
                  },
                  {
                     name: "https://www.oracle.com/security-alerts/cpuoct2021.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com/security-alerts/cpuoct2021.html",
                  },
                  {
                     name: "FEDORA-2021-5e376c0ed9",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/",
                  },
                  {
                     name: "DSA-5004",
                     refsource: "DEBIAN",
                     url: "https://www.debian.org/security/2021/dsa-5004",
                  },
                  {
                     name: "https://www.oracle.com/security-alerts/cpujan2022.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com/security-alerts/cpujan2022.html",
                  },
               ],
            },
            source: {
               advisory: "GHSA-f6hm-88x3-mfjv",
               discovery: "UNKNOWN",
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
      assignerShortName: "GitHub_M",
      cveId: "CVE-2021-21349",
      datePublished: "2021-03-22T23:45:24",
      dateReserved: "2020-12-22T00:00:00",
      dateUpdated: "2024-08-03T18:09:15.735Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2020-26217

Vulnerability from cvelistv5

Published

2020-11-16 21:00

Modified

2024-08-04 15:49

Severity ?

8.0 (High) - CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

Summary

XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream. Only users who rely on blocklists are affected. Anyone using XStream's Security Framework allowlist is not affected. The linked advisory provides code workarounds for users who cannot upgrade. The issue is fixed in version 1.4.14.

References

▼	URL	Tags
	https://github.com/x-stream/xstream/security/advisories/GHSA-mw36-7c6c-q4q2	x_refsource_CONFIRM
	https://x-stream.github.io/CVE-2020-26217.html	x_refsource_CONFIRM
	https://github.com/x-stream/xstream/commit/0fec095d534126931c99fd38e9c6d41f5c685c1a	x_refsource_CONFIRM
	https://lists.debian.org/debian-lts-announce/2020/12/msg00001.html	mailing-list, x_refsource_MLIST
	https://www.debian.org/security/2020/dsa-4811	vendor-advisory, x_refsource_DEBIAN
	https://lists.apache.org/thread.html/redde3609b89b2a4ff18b536a06ef9a77deb93d47fda8ed28086fa8c3%40%3Cissues.activemq.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r826a006fda71cc96fc87b6eca4b5d195f19a292ad36cea501682c38c%40%3Cissues.activemq.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r2de526726e7f4db4a7cb91b7355070779f51a84fd985c6529c2f4e9e%40%3Cissues.activemq.apache.org%3E	mailing-list, x_refsource_MLIST
	https://www.oracle.com/security-alerts/cpuApr2021.html	x_refsource_MISC
	https://security.netapp.com/advisory/ntap-20210409-0004/	x_refsource_CONFIRM
	https://www.oracle.com//security-alerts/cpujul2021.html	x_refsource_MISC
	https://lists.apache.org/thread.html/r7c9fc255edc0b9cd9567093d131f6d33fde4c662aaf912460ef630e9%40%3Ccommits.camel.apache.org%3E	mailing-list, x_refsource_MLIST
	https://www.oracle.com/security-alerts/cpuoct2021.html	x_refsource_MISC
	https://www.oracle.com/security-alerts/cpujan2022.html	x_refsource_MISC
	https://www.oracle.com/security-alerts/cpuapr2022.html	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	x-stream	xstream	Version: < 1.4.14

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T15:49:07.258Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://github.com/x-stream/xstream/security/advisories/GHSA-mw36-7c6c-q4q2",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://x-stream.github.io/CVE-2020-26217.html",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://github.com/x-stream/xstream/commit/0fec095d534126931c99fd38e9c6d41f5c685c1a",
               },
               {
                  name: "[debian-lts-announce] 20201201 [SECURITY] [DLA 2471-1] libxstream-java security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2020/12/msg00001.html",
               },
               {
                  name: "DSA-4811",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_DEBIAN",
                     "x_transferred",
                  ],
                  url: "https://www.debian.org/security/2020/dsa-4811",
               },
               {
                  name: "[activemq-issues] 20201230 [jira] [Created] (AMQ-8107) Does ActiveMQ use the affected functionality within Xstream libraries for CVE-2020-26217",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/redde3609b89b2a4ff18b536a06ef9a77deb93d47fda8ed28086fa8c3%40%3Cissues.activemq.apache.org%3E",
               },
               {
                  name: "[activemq-issues] 20201230 [jira] [Updated] (AMQ-8107) Does ActiveMQ use the affected functionality within Xstream libraries for CVE-2020-26217",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r826a006fda71cc96fc87b6eca4b5d195f19a292ad36cea501682c38c%40%3Cissues.activemq.apache.org%3E",
               },
               {
                  name: "[activemq-issues] 20210104 [jira] [Resolved] (AMQ-8107) Does ActiveMQ use the affected functionality within Xstream libraries for CVE-2020-26217",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r2de526726e7f4db4a7cb91b7355070779f51a84fd985c6529c2f4e9e%40%3Cissues.activemq.apache.org%3E",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpuApr2021.html",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20210409-0004/",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com//security-alerts/cpujul2021.html",
               },
               {
                  name: "[camel-commits] 20211006 [camel] branch main updated: Camel-XStream: Added a test about CVE-2020-26217",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r7c9fc255edc0b9cd9567093d131f6d33fde4c662aaf912460ef630e9%40%3Ccommits.camel.apache.org%3E",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpuoct2021.html",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpujan2022.html",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpuapr2022.html",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "xstream",
               vendor: "x-stream",
               versions: [
                  {
                     status: "affected",
                     version: "< 1.4.14",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream. Only users who rely on blocklists are affected. Anyone using XStream's Security Framework allowlist is not affected. The linked advisory provides code workarounds for users who cannot upgrade. The issue is fixed in version 1.4.14.",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 8,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "LOW",
                  scope: "CHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-78",
                     description: "CWE-78 OS Command Injection",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-04-19T23:22:18",
            orgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
            shortName: "GitHub_M",
         },
         references: [
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://github.com/x-stream/xstream/security/advisories/GHSA-mw36-7c6c-q4q2",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://x-stream.github.io/CVE-2020-26217.html",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://github.com/x-stream/xstream/commit/0fec095d534126931c99fd38e9c6d41f5c685c1a",
            },
            {
               name: "[debian-lts-announce] 20201201 [SECURITY] [DLA 2471-1] libxstream-java security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2020/12/msg00001.html",
            },
            {
               name: "DSA-4811",
               tags: [
                  "vendor-advisory",
                  "x_refsource_DEBIAN",
               ],
               url: "https://www.debian.org/security/2020/dsa-4811",
            },
            {
               name: "[activemq-issues] 20201230 [jira] [Created] (AMQ-8107) Does ActiveMQ use the affected functionality within Xstream libraries for CVE-2020-26217",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/redde3609b89b2a4ff18b536a06ef9a77deb93d47fda8ed28086fa8c3%40%3Cissues.activemq.apache.org%3E",
            },
            {
               name: "[activemq-issues] 20201230 [jira] [Updated] (AMQ-8107) Does ActiveMQ use the affected functionality within Xstream libraries for CVE-2020-26217",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r826a006fda71cc96fc87b6eca4b5d195f19a292ad36cea501682c38c%40%3Cissues.activemq.apache.org%3E",
            },
            {
               name: "[activemq-issues] 20210104 [jira] [Resolved] (AMQ-8107) Does ActiveMQ use the affected functionality within Xstream libraries for CVE-2020-26217",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r2de526726e7f4db4a7cb91b7355070779f51a84fd985c6529c2f4e9e%40%3Cissues.activemq.apache.org%3E",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com/security-alerts/cpuApr2021.html",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://security.netapp.com/advisory/ntap-20210409-0004/",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com//security-alerts/cpujul2021.html",
            },
            {
               name: "[camel-commits] 20211006 [camel] branch main updated: Camel-XStream: Added a test about CVE-2020-26217",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r7c9fc255edc0b9cd9567093d131f6d33fde4c662aaf912460ef630e9%40%3Ccommits.camel.apache.org%3E",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com/security-alerts/cpuoct2021.html",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com/security-alerts/cpujan2022.html",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com/security-alerts/cpuapr2022.html",
            },
         ],
         source: {
            advisory: "GHSA-mw36-7c6c-q4q2",
            discovery: "UNKNOWN",
         },
         title: "Remote Code Execution in XStream",
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "security-advisories@github.com",
               ID: "CVE-2020-26217",
               STATE: "PUBLIC",
               TITLE: "Remote Code Execution in XStream",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "xstream",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "< 1.4.14",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "x-stream",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream. Only users who rely on blocklists are affected. Anyone using XStream's Security Framework allowlist is not affected. The linked advisory provides code workarounds for users who cannot upgrade. The issue is fixed in version 1.4.14.",
                  },
               ],
            },
            impact: {
               cvss: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 8,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "LOW",
                  scope: "CHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H",
                  version: "3.1",
               },
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-78 OS Command Injection",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://github.com/x-stream/xstream/security/advisories/GHSA-mw36-7c6c-q4q2",
                     refsource: "CONFIRM",
                     url: "https://github.com/x-stream/xstream/security/advisories/GHSA-mw36-7c6c-q4q2",
                  },
                  {
                     name: "https://x-stream.github.io/CVE-2020-26217.html",
                     refsource: "CONFIRM",
                     url: "https://x-stream.github.io/CVE-2020-26217.html",
                  },
                  {
                     name: "https://github.com/x-stream/xstream/commit/0fec095d534126931c99fd38e9c6d41f5c685c1a",
                     refsource: "CONFIRM",
                     url: "https://github.com/x-stream/xstream/commit/0fec095d534126931c99fd38e9c6d41f5c685c1a",
                  },
                  {
                     name: "[debian-lts-announce] 20201201 [SECURITY] [DLA 2471-1] libxstream-java security update",
                     refsource: "MLIST",
                     url: "https://lists.debian.org/debian-lts-announce/2020/12/msg00001.html",
                  },
                  {
                     name: "DSA-4811",
                     refsource: "DEBIAN",
                     url: "https://www.debian.org/security/2020/dsa-4811",
                  },
                  {
                     name: "[activemq-issues] 20201230 [jira] [Created] (AMQ-8107) Does ActiveMQ use the affected functionality within Xstream libraries for CVE-2020-26217",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/redde3609b89b2a4ff18b536a06ef9a77deb93d47fda8ed28086fa8c3@%3Cissues.activemq.apache.org%3E",
                  },
                  {
                     name: "[activemq-issues] 20201230 [jira] [Updated] (AMQ-8107) Does ActiveMQ use the affected functionality within Xstream libraries for CVE-2020-26217",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r826a006fda71cc96fc87b6eca4b5d195f19a292ad36cea501682c38c@%3Cissues.activemq.apache.org%3E",
                  },
                  {
                     name: "[activemq-issues] 20210104 [jira] [Resolved] (AMQ-8107) Does ActiveMQ use the affected functionality within Xstream libraries for CVE-2020-26217",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r2de526726e7f4db4a7cb91b7355070779f51a84fd985c6529c2f4e9e@%3Cissues.activemq.apache.org%3E",
                  },
                  {
                     name: "https://www.oracle.com/security-alerts/cpuApr2021.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com/security-alerts/cpuApr2021.html",
                  },
                  {
                     name: "https://security.netapp.com/advisory/ntap-20210409-0004/",
                     refsource: "CONFIRM",
                     url: "https://security.netapp.com/advisory/ntap-20210409-0004/",
                  },
                  {
                     name: "https://www.oracle.com//security-alerts/cpujul2021.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com//security-alerts/cpujul2021.html",
                  },
                  {
                     name: "[camel-commits] 20211006 [camel] branch main updated: Camel-XStream: Added a test about CVE-2020-26217",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r7c9fc255edc0b9cd9567093d131f6d33fde4c662aaf912460ef630e9@%3Ccommits.camel.apache.org%3E",
                  },
                  {
                     name: "https://www.oracle.com/security-alerts/cpuoct2021.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com/security-alerts/cpuoct2021.html",
                  },
                  {
                     name: "https://www.oracle.com/security-alerts/cpujan2022.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com/security-alerts/cpujan2022.html",
                  },
                  {
                     name: "https://www.oracle.com/security-alerts/cpuapr2022.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com/security-alerts/cpuapr2022.html",
                  },
               ],
            },
            source: {
               advisory: "GHSA-mw36-7c6c-q4q2",
               discovery: "UNKNOWN",
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
      assignerShortName: "GitHub_M",
      cveId: "CVE-2020-26217",
      datePublished: "2020-11-16T21:00:18",
      dateReserved: "2020-10-01T00:00:00",
      dateUpdated: "2024-08-04T15:49:07.258Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2020-26259

Vulnerability from cvelistv5

Published

2020-12-16 01:05

Modified

2024-08-04 15:56

Severity ?

6.8 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N

Summary

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling. The vulnerability may allow a remote attacker to delete arbitrary know files on the host as log as the executing process has sufficient rights only by manipulating the processed input stream. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.15. The reported vulnerability does not exist running Java 15 or higher. No user is affected, who followed the recommendation to setup XStream's Security Framework with a whitelist! Anyone relying on XStream's default blacklist can immediately switch to a whilelist for the allowed types to avoid the vulnerability. Users of XStream 1.4.14 or below who still want to use XStream default blacklist can use a workaround described in more detailed in the referenced advisories.

References

▼	URL	Tags
	https://github.com/x-stream/xstream/security/advisories/GHSA-jfvx-7wrx-43fh	x_refsource_CONFIRM
	https://x-stream.github.io/CVE-2020-26259.html	x_refsource_MISC
	https://lists.apache.org/thread.html/r97993e3d78e1f5389b7b172ba9f308440830ce5f051ee62714a0aa34%40%3Ccommits.struts.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.debian.org/debian-lts-announce/2020/12/msg00042.html	mailing-list, x_refsource_MLIST
	https://www.debian.org/security/2021/dsa-4828	vendor-advisory, x_refsource_DEBIAN
	https://security.netapp.com/advisory/ntap-20210409-0005/	x_refsource_CONFIRM
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/	vendor-advisory, x_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/	vendor-advisory, x_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/	vendor-advisory, x_refsource_FEDORA

Impacted products

	Vendor	Product	Version
	x-stream	xstream	Version: < 1.4.15

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T15:56:04.167Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://github.com/x-stream/xstream/security/advisories/GHSA-jfvx-7wrx-43fh",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://x-stream.github.io/CVE-2020-26259.html",
               },
               {
                  name: "[struts-commits] 20201221 [struts] branch master updated: Upgrades XStream to version 1.4.15 to address CVE-2020-26258, CVE-2020-26259",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r97993e3d78e1f5389b7b172ba9f308440830ce5f051ee62714a0aa34%40%3Ccommits.struts.apache.org%3E",
               },
               {
                  name: "[debian-lts-announce] 20201231 [SECURITY] [DLA 2507-1] libxstream-java security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2020/12/msg00042.html",
               },
               {
                  name: "DSA-4828",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_DEBIAN",
                     "x_transferred",
                  ],
                  url: "https://www.debian.org/security/2021/dsa-4828",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20210409-0005/",
               },
               {
                  name: "FEDORA-2021-fbad11014a",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/",
               },
               {
                  name: "FEDORA-2021-d894ca87dc",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/",
               },
               {
                  name: "FEDORA-2021-5e376c0ed9",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "xstream",
               vendor: "x-stream",
               versions: [
                  {
                     status: "affected",
                     version: "< 1.4.15",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling. The vulnerability may allow a remote attacker to delete arbitrary know files on the host as log as the executing process has sufficient rights only by manipulating the processed input stream. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.15. The reported vulnerability does not exist running Java 15 or higher. No user is affected, who followed the recommendation to setup XStream's Security Framework with a whitelist! Anyone relying on XStream's default blacklist can immediately switch to a whilelist for the allowed types to avoid the vulnerability. Users of XStream 1.4.14 or below who still want to use XStream default blacklist can use a workaround described in more detailed in the referenced advisories.",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 6.8,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "NONE",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "CHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-78",
                     description: "CWE-78 OS Command Injection",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2021-10-30T01:08:04",
            orgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
            shortName: "GitHub_M",
         },
         references: [
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://github.com/x-stream/xstream/security/advisories/GHSA-jfvx-7wrx-43fh",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://x-stream.github.io/CVE-2020-26259.html",
            },
            {
               name: "[struts-commits] 20201221 [struts] branch master updated: Upgrades XStream to version 1.4.15 to address CVE-2020-26258, CVE-2020-26259",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r97993e3d78e1f5389b7b172ba9f308440830ce5f051ee62714a0aa34%40%3Ccommits.struts.apache.org%3E",
            },
            {
               name: "[debian-lts-announce] 20201231 [SECURITY] [DLA 2507-1] libxstream-java security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2020/12/msg00042.html",
            },
            {
               name: "DSA-4828",
               tags: [
                  "vendor-advisory",
                  "x_refsource_DEBIAN",
               ],
               url: "https://www.debian.org/security/2021/dsa-4828",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://security.netapp.com/advisory/ntap-20210409-0005/",
            },
            {
               name: "FEDORA-2021-fbad11014a",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/",
            },
            {
               name: "FEDORA-2021-d894ca87dc",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/",
            },
            {
               name: "FEDORA-2021-5e376c0ed9",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/",
            },
         ],
         source: {
            advisory: "GHSA-jfvx-7wrx-43fh",
            discovery: "UNKNOWN",
         },
         title: "XStream is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling",
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "security-advisories@github.com",
               ID: "CVE-2020-26259",
               STATE: "PUBLIC",
               TITLE: "XStream is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "xstream",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "< 1.4.15",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "x-stream",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling. The vulnerability may allow a remote attacker to delete arbitrary know files on the host as log as the executing process has sufficient rights only by manipulating the processed input stream. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.15. The reported vulnerability does not exist running Java 15 or higher. No user is affected, who followed the recommendation to setup XStream's Security Framework with a whitelist! Anyone relying on XStream's default blacklist can immediately switch to a whilelist for the allowed types to avoid the vulnerability. Users of XStream 1.4.14 or below who still want to use XStream default blacklist can use a workaround described in more detailed in the referenced advisories.",
                  },
               ],
            },
            impact: {
               cvss: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 6.8,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "NONE",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "CHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N",
                  version: "3.1",
               },
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-78 OS Command Injection",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://github.com/x-stream/xstream/security/advisories/GHSA-jfvx-7wrx-43fh",
                     refsource: "CONFIRM",
                     url: "https://github.com/x-stream/xstream/security/advisories/GHSA-jfvx-7wrx-43fh",
                  },
                  {
                     name: "https://x-stream.github.io/CVE-2020-26259.html",
                     refsource: "MISC",
                     url: "https://x-stream.github.io/CVE-2020-26259.html",
                  },
                  {
                     name: "[struts-commits] 20201221 [struts] branch master updated: Upgrades XStream to version 1.4.15 to address CVE-2020-26258, CVE-2020-26259",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r97993e3d78e1f5389b7b172ba9f308440830ce5f051ee62714a0aa34@%3Ccommits.struts.apache.org%3E",
                  },
                  {
                     name: "[debian-lts-announce] 20201231 [SECURITY] [DLA 2507-1] libxstream-java security update",
                     refsource: "MLIST",
                     url: "https://lists.debian.org/debian-lts-announce/2020/12/msg00042.html",
                  },
                  {
                     name: "DSA-4828",
                     refsource: "DEBIAN",
                     url: "https://www.debian.org/security/2021/dsa-4828",
                  },
                  {
                     name: "https://security.netapp.com/advisory/ntap-20210409-0005/",
                     refsource: "CONFIRM",
                     url: "https://security.netapp.com/advisory/ntap-20210409-0005/",
                  },
                  {
                     name: "FEDORA-2021-fbad11014a",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/",
                  },
                  {
                     name: "FEDORA-2021-d894ca87dc",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/",
                  },
                  {
                     name: "FEDORA-2021-5e376c0ed9",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/",
                  },
               ],
            },
            source: {
               advisory: "GHSA-jfvx-7wrx-43fh",
               discovery: "UNKNOWN",
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
      assignerShortName: "GitHub_M",
      cveId: "CVE-2020-26259",
      datePublished: "2020-12-16T01:05:16",
      dateReserved: "2020-10-01T00:00:00",
      dateUpdated: "2024-08-04T15:56:04.167Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

Vulnerability from csaf_opensuse

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature