CVE-2021-39150: A Server-Side Forgery Request vulnerability in XStream via PriorityQueue unmarshaling
A flaw was found in xstream, a simple library used to serialize objects to XML and back again. This flaw allows a remote attacker to request data from internal resources that are not publicly available by manipulating the processed input stream with Java runtime versions 14 to 8. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
Other sources
XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream with a Java runtime version 14 to 8. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.18.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/xstreamto a version that resolves this vulnerability.Fixed in 0:1.3.1-16.el7_9 - Upgrade
Upgrade
debian/libxstream-javato a version that resolves this vulnerability.Fixed in 1.4.11.1-1+deb10u3Fixed in 1.4.11.1-1+deb10u4Fixed in 1.4.15-3+deb11u2Fixed in 1.4.20-1 - Upgrade
Upgrade
redhat/xstreamto a version that resolves this vulnerability.Fixed in 1.4.18 - Upgrade
Upgrade
xstreamto a version that resolves this vulnerability.Fixed in 1.4.18 - Compensating control
If using XStream, set up XStream's security framework using a whitelist limited to the minimal required types (the material notes users are not affected when following this recommendation).
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2021-39150?
CVE-2021-39150 is a vulnerability in the XStream library that allows a remote attacker to request data from internal resources by manipulating the input stream with a specific Java runtime version.
What is the severity of CVE-2021-39150?
CVE-2021-39150 has a severity rating of 8.5, which is considered high.
Which software versions are affected by CVE-2021-39150?
CVE-2021-39150 affects XStream versions up to but excluding 1.4.18 on Red Hat, versions up to but excluding 0:1.3.1-16.el7_9 on Red Hat EL7_9, and various versions of libxstream-java on Debian.
How can I fix CVE-2021-39150?
To fix CVE-2021-39150, update XStream to version 1.4.18 on Red Hat, version 0:1.3.1-16.el7_9 on Red Hat EL7_9, or upgrade to a fixed version of libxstream-java on Debian.
Where can I find more information about CVE-2021-39150?
For more information about CVE-2021-39150, you can refer to the official XStream security page and the GitHub advisory.