CVE-2021-39146: XStream is vulnerable to an Arbitrary Code Execution attack
A flaw was found in xstream, a simple library used to serialize objects to XML and back again. This flaw allows a remote attacker to load and execute arbitrary code from a remote host by manipulating the processed input stream. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
Other sources
XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/xstreamto a version that resolves this vulnerability.Fixed in 0:1.3.1-16.el7_9 - Upgrade
Upgrade
debian/libxstream-javato a version that resolves this vulnerability.Fixed in 1.4.11.1-1+deb10u3Fixed in 1.4.11.1-1+deb10u4Fixed in 1.4.15-3+deb11u2Fixed in 1.4.20-1 - Upgrade
Upgrade
redhat/xstreamto a version that resolves this vulnerability.Fixed in 1.4.18 - Upgrade
Upgrade
xstreamto a version that resolves this vulnerability.Fixed in 1.4.18 - Configuration
Set up XStream's security framework and configure a whitelist limited to the minimal required types.
XStream security framework whitelist limited to the minimal required types = enabled (whitelist limited to minimal required types)
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2021-39146?
CVE-2021-39146 is a vulnerability in XStream, a library used to serialize objects to XML and back again.
How does CVE-2021-39146 impact users?
CVE-2021-39146 allows a remote attacker to load and execute arbitrary code from a remote host by manipulating the processed input stream.
Who is affected by CVE-2021-39146?
Users of XStream versions prior to 1.4.18 or 1.3.1-16.el7_9 are affected by CVE-2021-39146.
How can CVE-2021-39146 be fixed?
To fix CVE-2021-39146, users should update XStream to version 1.4.18 or 1.3.1-16.el7_9, depending on the affected version.
Where can I find more information about CVE-2021-39146?
More information about CVE-2021-39146 can be found at the following references: [Link 1](https://github.com/x-stream/xstream/security/advisories/GHSA-p8pq-r894-fm8f), [Link 2](https://x-stream.github.io/CVE-2021-39146.html), [Link 3](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1997778)