CVE-2021-39144: XStream is vulnerable to a Remote Command Execution attack
A flaw was found in xstream, a simple library used to serialize objects to XML and back again. This flaw allows a remote attacker to load and execute arbitrary code from a remote host by manipulating the processed input stream.
Other sources
XStream contains a remote code execution vulnerability that allows an attacker to manipulate the processed input stream and replace or inject objects that result in the execution of a local command on the server. This vulnerability can affect multiple products, including but not limited to VMware Cloud Foundation.
— CISA
XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/xstreamto a version that resolves this vulnerability.Fixed in 0:1.3.1-16.el7_9 - Upgrade
Upgrade
debian/libxstream-javato a version that resolves this vulnerability.Fixed in 1.4.11.1-1+deb10u3Fixed in 1.4.11.1-1+deb10u4Fixed in 1.4.15-3+deb11u2Fixed in 1.4.20-1 - Upgrade
Upgrade
redhat/xstreamto a version that resolves this vulnerability.Fixed in 1.4.18 - Upgrade
Upgrade
x-stream/xstreamto a version that resolves this vulnerability.Fixed in 1.4.18 - Configuration
Ensure XStream is configured to use its security framework with a whitelist limited to the minimal required types, as recommended in the advisory.
XStream XStream security framework whitelist (minimal required types) = enabled (whitelist limited to minimal required types)
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2021-39144?
CVE-2021-39144 is a remote code execution vulnerability in XStream, a library for serializing objects to XML and back.
Who is affected by CVE-2021-39144?
Any system or application that uses an affected version of XStream may be affected by CVE-2021-39144.
What is the severity of CVE-2021-39144?
CVE-2021-39144 has a severity rating of 8.5, which is classified as high.
How can I fix CVE-2021-39144?
To fix CVE-2021-39144, you should update to XStream version 1.4.18 or higher.
Where can I find more information about CVE-2021-39144?
You can find more information about CVE-2021-39144 at the following references: [link1], [link2], [link3].