CVE-2021-21343: XStream is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling as long as the executing process has sufficient rights
Last updated 22 August 2024
Other sources
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability where the processed stream at unmarshalling time contains type information to recreate the formerly written objects. XStream creates therefore new instances based on these type information. An attacker can manipulate the processed input stream and replace or inject objects, that result in the deletion of a file on the local host. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/libxstream-javato a version that resolves this vulnerability.Fixed in 1.4.15-3+deb11u2Fixed in 1.4.15-3+deb11u3Fixed in 1.4.20-1+deb12u1Fixed in 1.4.21-1 - Upgrade
Upgrade
redhat/xstreamto a version that resolves this vulnerability.Fixed in 1.4.16 - Upgrade
Upgrade
x-stream/xstreamto a version that resolves this vulnerability.Fixed in 1.4.16 - Configuration
Configure XStream's security framework with a whitelist limited to the minimal required types.
XStream Security Framework whitelist = minimal required types
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2021-21343?
The severity of CVE-2021-21343 is medium with a CVSS score of 5.9.
What is XStream?
XStream is a Java library used for serializing objects to XML and deserializing XML back to objects.
What is the vulnerability in XStream?
The vulnerability in XStream is that the processed stream at unmarshalling time contains type information that can be used to recreate the formerly written objects.
What version of XStream is affected by CVE-2021-21343?
XStream versions up to, but excluding, version 1.4.16 are affected by CVE-2021-21343.
How can I fix CVE-2021-21343?
To fix CVE-2021-21343, update XStream to version 1.4.16 or later.