RHSA-2021:3956: Important: xstream security update
XStream is a Java XML serialization library to serialize objects to and deserialize object from XML.<br>Security Fix(es):<br><li> xstream: Arbitrary code execution via unsafe deserialization of Xalan xsltc.trax.TemplatesImpl (CVE-2021-39139)</li> <li> xstream: Arbitrary code execution via unsafe deserialization of com.sun.xml.internal.ws.client.sei. (CVE-2021-39141)</li> <li> xstream: Arbitrary code execution via unsafe deserialization of sun.tracing. (CVE-2021-39144)</li> <li> xstream: Arbitrary code execution via unsafe deserialization of com.sun.jndi.ldap.LdapBindingEnumeration (CVE-2021-39145)</li> <li> xstream: Arbitrary code execution via unsafe deserialization of javax.swing.UIDefaults$ProxyLazyValue (CVE-2021-39146)</li> <li> xstream: Arbitrary code execution via unsafe deserialization of com.sun.jndi.ldap.LdapSearchEnumeration (CVE-2021-39147)</li> <li> xstream: Arbitrary code execution via unsafe deserialization of com.sun.jndi.toolkit.dir.ContextEnumerator (CVE-2021-39148)</li> <li> xstream: Arbitrary code execution via unsafe deserialization of com.sun.corba. (CVE-2021-39149)</li> <li> xstream: Server-side request forgery (SSRF) via unsafe deserialization of com.sun.xml.internal.ws.client.sei. (CVE-2021-39150)</li> <li> xstream: Arbitrary code execution via unsafe deserialization of com.sun.jndi.ldap.LdapBindingEnumeration (CVE-2021-39151)</li> <li> xstream: Server-side request forgery (SSRF) via unsafe deserialization of jdk.nashorn.internal.runtime.Source$URLData (CVE-2021-39152)</li> <li> xstream: Arbitrary code execution via unsafe deserialization of Xalan xsltc.trax.TemplatesImpl (CVE-2021-39153)</li> <li> xstream: Arbitrary code execution via unsafe deserialization of javax.swing.UIDefaults$ProxyLazyValue (CVE-2021-39154)</li> <li> xstream: Infinite loop DoS via unsafe deserialization of sun.reflect.annotation.AnnotationInvocationHandler (CVE-2021-39140)</li> For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2021:3956?
The severity of RHSA-2021:3956 is critical due to arbitrary code execution vulnerabilities.
How do I fix RHSA-2021:3956?
To fix RHSA-2021:3956, upgrade to xstream version 1.3.1-16.el7_9 or later.
What vulnerabilities are addressed by RHSA-2021:3956?
RHSA-2021:3956 addresses arbitrary code execution vulnerabilities related to unsafe deserialization of Xalan xsltc.trax.TemplatesImpl.
Which software versions are affected by RHSA-2021:3956?
RHSA-2021:3956 affects xstream versions prior to 1.3.1-16.el7_9.
Is RHSA-2021:3956 applicable to both xstream and xstream-javadoc packages?
Yes, RHSA-2021:3956 applies to both xstream and xstream-javadoc packages.