CVE-2021-39139: XStream is vulnerable to an Arbitrary Code Execution attack
A flaw was found in xstream, a simple library used to serialize objects to XML and back again. This flaw allows a remote attacker to load and execute arbitrary code from a remote host by manipulating the processed input stream. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
Other sources
XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. A user is only affected if using the version out of the box with JDK 1.7u21 or below. However, this scenario can be adjusted easily to an external Xalan that works regardless of the version of the Java runtime. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/xstreamto a version that resolves this vulnerability.Fixed in 0:1.3.1-16.el7_9 - Upgrade
Upgrade
debian/libxstream-javato a version that resolves this vulnerability.Fixed in 1.4.11.1-1+deb10u3Fixed in 1.4.11.1-1+deb10u4Fixed in 1.4.15-3+deb11u2Fixed in 1.4.20-1 - Upgrade
Upgrade
redhat/xstreamto a version that resolves this vulnerability.Fixed in 1.4.18 - Upgrade
Upgrade
XStreamto a version that resolves this vulnerability.Fixed in 1.4.18 - Configuration
Configure XStream’s security framework to use a whitelist limited to the minimal required types to avoid exploitation via manipulated input streams (note: the described affected scenario applies to the out-of-the-box versions with JDK 1.7u21 or below).
XStream XStream security framework whitelist (limited to minimal required types) = Enabled / enforced with a whitelist limited to the minimal required types - Compensating control
If you cannot rely on the default JDK behavior (affected only for out-of-the-box use with JDK 1.7u21 or below), adjust the setup to use an external Xalan that works regardless of the version of the Java runtime.
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2021-39139?
CVE-2021-39139 is a vulnerability in the XStream library that allows a remote attacker to load and execute arbitrary code from a remote host by manipulating the input stream.
How does CVE-2021-39139 impact users?
Users are affected if they are using XStream version 1.3.1-16.el7_9 or version 1.4.18.
What is the severity of CVE-2021-39139?
CVE-2021-39139 has a severity rating of 8.5 (high).
How can I fix CVE-2021-39139?
To fix CVE-2021-39139, users should update XStream to version 1.4.18 or apply the remedy package 0:1.3.1-16.el7_9.
Where can I find more information about CVE-2021-39139?
More information about CVE-2021-39139 can be found at the following references: [CVE-2021-39139](https://www.cve.org/CVERecord?id=CVE-2021-39139), [NVD](https://nvd.nist.gov/vuln/detail/CVE-2021-39139), [GitHub Security Advisory](https://github.com/x-stream/xstream/security/advisories/GHSA-64xx-cq4q-mf44), [Red Hat Bugzilla](https://bugzilla.redhat.com/show_bug.cgi?id=1997763), [Red Hat Advisory](https://access.redhat.com/errata/RHSA-2022:0520).