CVE-2021-43859: Denial of Service by injecting highly recursive collections or maps in XStream
XStream is an open source java library to serialize objects to XML and back again. Versions prior to 1.4.19 may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a payload resulting in a denial of service only by manipulating the processed input stream. XStream 1.4.19 monitors and accumulates the time it takes to add elements to collections and throws an exception if a set threshold is exceeded. Users are advised to upgrade as soon as possible. Users unable to upgrade may set the NOREFERENCE mode to prevent recursion. See GHSA-rmr5-cpv2-vgjf for further details on a workaround if an upgrade is not possible.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/jenkinsto a version that resolves this vulnerability.Fixed in 0:2.319.3.1650348949-1.el7 - Upgrade
Upgrade
redhat/xstreamto a version that resolves this vulnerability.Fixed in 1.4.19 - Upgrade
Upgrade
x-stream/xstreamto a version that resolves this vulnerability.Fixed in 1.4.19 - Configuration
If you cannot upgrade, set XStream to NO_REFERENCE mode to prevent highly recursive collections/maps from causing denial of service.
XStream NO_REFERENCE mode = set to prevent recursion
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2021-43859?
CVE-2021-43859 is a vulnerability in XStream, an open source Java library, that allows a remote attacker to allocate 100% CPU time on the target system resulting in a denial of service.
What is the severity of CVE-2021-43859?
CVE-2021-43859 has a severity rating of 7.5 out of 10, which is considered high.
How does CVE-2021-43859 affect XStream?
CVE-2021-43859 affects XStream versions prior to 1.4.19.
How can I fix CVE-2021-43859?
To fix CVE-2021-43859, update XStream to version 1.4.19 or later.
Where can I find more information about CVE-2021-43859?
You can find more information about CVE-2021-43859 on the GitHub Security Advisory page and the XStream CVE-2021-43859 page.