CVE-2021-21348

moderate-risk

Published 2021-03-23

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to occupy a thread that consumes maximum CPU time and will never return. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.

Do I need to act?

0.26% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 5.3/10 Medium

NETWORK / HIGH complexity

Affected Products (20)

Oncommand Insight

Activemq

Jmeter

Xstream

Debian Linux

Fedora

Banking Enterprise Default Management

Banking Platform

Banking Virtual Account Management

Affected Vendors

Debian Apache Oracle Fedoraproject Netapp Xstream

References (30)

Release Notes http://x-stream.github.io/changes.html#1.4.16

Third Party Advisory https://github.com/x-stream/xstream/security/advisories/GHSA-56p8-3fh9-4cvq

Issue Tracking https://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae...

Issue Tracking https://lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fa...

Mailing List https://lists.debian.org/debian-lts-announce/2021/04/msg00002.html

Mailing List https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...

Third Party Advisory https://security.netapp.com/advisory/ntap-20210430-0002/

Mailing List https://www.debian.org/security/2021/dsa-5004

Third Party Advisory https://www.oracle.com//security-alerts/cpujul2021.html

Patch https://www.oracle.com/security-alerts/cpujan2022.html

Third Party Advisory https://www.oracle.com/security-alerts/cpuoct2021.html

Third Party Advisory https://x-stream.github.io/CVE-2021-21348.html

Mitigation https://x-stream.github.io/security.html#workaround

Release Notes http://x-stream.github.io/changes.html#1.4.16

Third Party Advisory https://github.com/x-stream/xstream/security/advisories/GHSA-56p8-3fh9-4cvq

Issue Tracking https://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae...

Issue Tracking https://lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fa...

Mailing List https://lists.debian.org/debian-lts-announce/2021/04/msg00002.html

and 10 more references

/ 100

moderate-risk

Severity 17/34 · Moderate

Exploitability 1/34 · Minimal

Exposure 24/34 · High