RHSA-2021:1354: Important: xstream security update
XStream is a Java XML serialization library to serialize objects to and deserialize object from XML.<br>Security Fix(es):<br><li> XStream: Unsafe deserizaliation of javax.sql.rowset.BaseRowSet (CVE-2021-21344)</li> <li> XStream: Unsafe deserizaliation of com.sun.corba.se.impl.activation.ServerTableEntry (CVE-2021-21345)</li> <li> XStream: Unsafe deserizaliation of sun.swing.SwingLazyValue (CVE-2021-21346)</li> <li> XStream: Unsafe deserizaliation of com.sun.tools.javac.processing.JavacProcessingEnvironment NameProcessIterator (CVE-2021-21347)</li> <li> XStream: Unsafe deserizaliation of com.sun.org.apache.bcel.internal.util.ClassLoader (CVE-2021-21350)</li> For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2021:1354?
RHSA-2021:1354 is classified as a moderate severity vulnerability due to unsafe deserialization issues in XStream.
How do I fix RHSA-2021:1354?
To fix RHSA-2021:1354, you should update the XStream package to version 1.3.1-13.el7_9 or later.
What components are affected by RHSA-2021:1354?
RHSA-2021:1354 affects the xstream and xstream-javadoc packages on Red Hat systems.
What vulnerabilities are addressed in RHSA-2021:1354?
RHSA-2021:1354 addresses the CVE-2021-21344 vulnerability related to unsafe deserialization in XStream.
Is RHSA-2021:1354 applicable to all Red Hat versions?
RHSA-2021:1354 specifically applies to Red Hat systems running the affected versions of XStream, particularly on EL7.