- Vulnerability/
- USN-4943-1
USN-4943-1: XStream vulnerabilities
First published: Tue May 11 2021(Updated: )
Zhihong Tian and Hui Lu found that XStream was vulnerable to remote code execution. A remote attacker could run arbitrary shell commands by manipulating the processed input stream. This issue affected only affected Ubuntu 20.10. (CVE-2020-26217) It was discovered that XStream was vulnerable to server-side forgery attacks. A remote attacker could request data from internal resources that are not publicly available only by manipulating the processed input stream. This issue only affected Ubuntu 20.10. (CVE-2020-26258) It was discovered that XStream was vulnerable to arbitrary file deletion on the local host. A remote attacker could use this to delete arbitrary known files on the host as long as the executing process had sufficient rights only by manipulating the processed input stream. This issue only affected Ubuntu 20.10. (CVE-2020-26259) It was discovered that XStream was vulnerable to denial of service, arbitrary code execution, arbitrary file deletion and server-side forgery attacks. A remote attacker could cause any of those issues by manipulating the processed input stream. (CVE-2021-21341, CVE-2021-21342, CVE-2021-21343 CVE-2021-21344, CVE-2021-21345, CVE-2021-21346, CVE-2021-21347, CVE-2021-21348, CVE-2021-21349, CVE-2021-21350, CVE-2021-21351)
| Affected Software | Affected Version | How to fix |
|---|---|---|
| All of | ||
| ubuntu/libxstream-java | <1.4.15-1ubuntu0.1 | 1.4.15-1ubuntu0.1 |
| Ubuntu Ubuntu | =21.04 | |
| All of | ||
| ubuntu/libxstream-java | <1.4.11.1-2ubuntu0.1 | 1.4.11.1-2ubuntu0.1 |
| Ubuntu Ubuntu | =20.10 | |
| All of | ||
| ubuntu/libxstream-java | <1.4.11.1-1ubuntu0.2 | 1.4.11.1-1ubuntu0.2 |
| Ubuntu Ubuntu | =20.04 | |
| All of | ||
| ubuntu/libxstream-java | <1.4.11.1-1~18.04.2 | 1.4.11.1-1~18.04.2 |
| Ubuntu Ubuntu | =18.04 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://ubuntu.com/security/CVE-2020-26258
- https://ubuntu.com/security/CVE-2021-21351
- https://ubuntu.com/security/CVE-2021-21342
- https://ubuntu.com/security/CVE-2020-26259
- https://ubuntu.com/security/CVE-2021-21346
- https://ubuntu.com/security/CVE-2021-21345
- https://ubuntu.com/security/CVE-2021-21348
- https://ubuntu.com/security/CVE-2021-21349
- https://ubuntu.com/security/CVE-2021-21343
- https://ubuntu.com/security/CVE-2020-26217
- https://ubuntu.com/security/CVE-2021-21350
- https://ubuntu.com/security/CVE-2021-21347
- https://ubuntu.com/security/CVE-2021-21341
- https://ubuntu.com/security/CVE-2021-21344
- https://ubuntu.com/security/notices/USN-4714-1
- https://ubuntu.com/security/notices/USN-6978-1
- https://launchpad.net/ubuntu/+source/libxstream-java/1.4.15-1ubuntu0.1
- https://launchpad.net/ubuntu/+source/libxstream-java/1.4.11.1-2ubuntu0.1
- https://launchpad.net/ubuntu/+source/libxstream-java/1.4.11.1-1ubuntu0.2
- https://launchpad.net/ubuntu/+source/libxstream-java/1.4.11.1-1~18.04.2
- https://ubuntu.com/security/notices/USN-4943-1 (Advisory)
Child vulnerabilities
(Contains the following vulnerabilities)
- agent/severity
- agent/title
- agent/last-modified-date
- agent/softwarecombine
- agent/type
- agent/description
- agent/event
- agent/first-publish-date
- collector/usn
- source/Ubuntu
- anchor-related/USN-4714-1
- anchor-related/USN-6978-1
- agent/software-canonical-lookup
- agent/references
- agent/tags
- agent/trending
- package-manager/ubuntu
- vendor/ubuntu
- canonical/ubuntu ubuntu
- version/ubuntu ubuntu/21.04
- version/ubuntu ubuntu/20.10
- version/ubuntu ubuntu/20.04
- version/ubuntu ubuntu/18.04