CVE-2021-21345

high-risk

Published 2021-03-23

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker who has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.

Do I need to act?

88.1% chance of exploitation in next 30 days

EPSS score — higher than 12% of all CVEs

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 5.8/10 Medium

NETWORK / HIGH complexity

Affected Products (20)

Oncommand Insight

Activemq

Jmeter

Xstream

Debian Linux

Fedora

Banking Enterprise Default Management

Banking Platform

Banking Virtual Account Management

Affected Vendors

Debian Apache Oracle Fedoraproject Netapp Xstream

References (32)

Release Notes http://x-stream.github.io/changes.html#1.4.16

Third Party Advisory https://github.com/x-stream/xstream/security/advisories/GHSA-hwpc-8xqv-jvj4

Issue Tracking https://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae...

Issue Tracking https://lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fa...

Mailing List https://lists.debian.org/debian-lts-announce/2021/04/msg00002.html

Mailing List https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...

Third Party Advisory https://security.netapp.com/advisory/ntap-20210430-0002/

Mailing List https://www.debian.org/security/2021/dsa-5004

Third Party Advisory https://www.oracle.com//security-alerts/cpujul2021.html

Patch https://www.oracle.com/security-alerts/cpuApr2021.html

Patch https://www.oracle.com/security-alerts/cpujan2022.html

Third Party Advisory https://www.oracle.com/security-alerts/cpuoct2021.html

Exploit https://x-stream.github.io/CVE-2021-21345.html

Mitigation https://x-stream.github.io/security.html#workaround

Release Notes http://x-stream.github.io/changes.html#1.4.16

Third Party Advisory https://github.com/x-stream/xstream/security/advisories/GHSA-hwpc-8xqv-jvj4

Issue Tracking https://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae...

Issue Tracking https://lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fa...

and 12 more references

/ 100

high-risk

Severity 18/34 · Moderate

Exploitability 20/34 · Moderate

Exposure 24/34 · High