CVE-2021-21342
Published on: 03/22/2021 12:00:00 AM UTC
Last Modified on: 03/09/2023 03:18:00 PM UTC
Certain versions of Debian Linux from Debian contain the following vulnerability:
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability where the processed stream at unmarshalling time contains type information to recreate the formerly written objects. XStream creates therefore new instances based on these type information. An attacker can manipulate the processed input stream and replace or inject objects, that result in a server-side forgery request. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.
- CVE-2021-21342 has been assigned by
[email protected] to track the vulnerability - currently rated as CRITICAL severity. - Affected Vendor/Software: x-stream - xstream version < 1.4.16
CVSS3 Score: 9.1 - CRITICAL
| Attack Vector ⓘ |
Attack Complexity |
Privileges Required |
User Interaction |
|---|---|---|---|
| NETWORK | LOW | NONE | NONE |
| Scope | Confidentiality Impact |
Integrity Impact |
Availability Impact |
| UNCHANGED | HIGH | HIGH | NONE |
CVSS2 Score: 5.8 - MEDIUM
| Access Vector ⓘ |
Access Complexity |
Authentication |
|---|---|---|
| NETWORK | MEDIUM | NONE |
| Confidentiality Impact |
Integrity Impact |
Availability Impact |
| PARTIAL | PARTIAL | NONE |
CVE References
| Description | Tags ⓘ | Link |
|---|---|---|
| [SECURITY] Fedora 34 Update: xstream-1.4.18-2.fc34 - package-announce - Fedora Mailing-Lists | lists.fedoraproject.org text/html |
FEDORA FEDORA-2021-d894ca87dc |
| XStream - Change History | x-stream.github.io text/html |
MISC x-stream.github.io/changes.html#1.4.16 |
| March 2021 XStream Vulnerabilities in NetApp Products | NetApp Product Security | security.netapp.com text/html |
CONFIRM security.netapp.com/advisory/ntap-20210430-0002/ |
| Oracle Critical Patch Update Advisory - July 2021 | www.oracle.com text/html |
MISC www.oracle.com//security-alerts/cpujul2021.html |
| No Description Provided | lists.apache.org Inactive LinkNot Archived |
MLIST [jmeter-dev] 20210406 [GitHub] [jmeter] sseide opened a new pull request #655: update x-stream to 1.4.16 (from 1.4.15) |
| Oracle Critical Patch Update Advisory - October 2021 | www.oracle.com text/html |
MISC www.oracle.com/security-alerts/cpuoct2021.html |
| Oracle Critical Patch Update Advisory - January 2022 | www.oracle.com text/html |
MISC www.oracle.com/security-alerts/cpujan2022.html |
| Debian -- Security Information -- DSA-5004-1 libxstream-java | www.debian.org Depreciated Link text/html |
DEBIAN DSA-5004 |
| XStream - Security Aspects | x-stream.github.io text/html |
MISC x-stream.github.io/security.html#workaround |
| XStream - CVE-2021-21342 | x-stream.github.io text/html |
MISC x-stream.github.io/CVE-2021-21342.html |
| A Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host · Advisory · x-stream/xstream · GitHub | github.com text/html |
CONFIRM github.com/x-stream/xstream/security/advisories/GHSA-hvv8-336g-rx3m |
| [SECURITY] Fedora 33 Update: xstream-1.4.18-2.fc33 - package-announce - Fedora Mailing-Lists | lists.fedoraproject.org text/html |
FEDORA FEDORA-2021-fbad11014a |
| Pony Mail! | lists.apache.org text/html |
MLIST [activemq-users] 20210427 Release date for ActiveMQ v5.16.2 to fix CVEs |
| [SECURITY] Fedora 35 Update: xstream-1.4.18-2.fc35 - package-announce - Fedora Mailing-Lists | lists.fedoraproject.org text/html |
FEDORA FEDORA-2021-5e376c0ed9 |
| [SECURITY] [DLA 2616-1] libxstream-java security update | lists.debian.org text/html |
MLIST [debian-lts-announce] 20210403 [SECURITY] [DLA 2616-1] libxstream-java security update |
Related QID Numbers
- 178511 Debian Security Update for libxstream-java (DLA 2616-1)
- 178889 Debian Security Update for libxstream-java (DSA 5004-1)
- 178890 Debian Security Update for libxstream-java (DSA 5004-1)
- 180223 Debian Security Update for libxstream-java (CVE-2021-21342)
- 198361 Ubuntu Security Notification for XStream vulnerabilities (USN-4943-1)
- 281980 Fedora Security Update for xstream (FEDORA-2021-d894ca87dc)
- 281981 Fedora Security Update for xstream (FEDORA-2021-fbad11014a)
- 354921 Amazon Linux Security Advisory for xstream : ALAS2-2023-2030
- 375827 XStream Arbitrary Code Execution And Multiple vulnerabilities
- 730155 McAfee Web Gateway Multiple Vulnerabilities(WP-3580, WP-3656, WP-3815, WP-3878, WP-3882, WP-3934,WP-3935, WP-3936, WP-3999)
- 750094 SUSE Enterprise Linux Security Update for xstream (SUSE-SU-2021:1840-1)
- 750177 OpenSUSE Security Update for xstream (openSUSE-SU-2021:0832-1)
- 750773 OpenSUSE Security Update for xstream (openSUSE-SU-2021:1840-1)
- 980129 Java (maven) Security Update for com.thoughtworks.xstream:xstream (GHSA-hvv8-336g-rx3m)
Known Affected Configurations (CPE V2.3)
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*:
- cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*:
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*:
- cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*:
- cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*:
- cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:banking_enterprise_default_management:2.10.0:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:banking_enterprise_default_management:2.12.0:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:banking_platform:2.12.0:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:banking_platform:2.4.0:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:banking_platform:2.7.1:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:banking_platform:2.9.0:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:banking_virtual_account_management:14.2.0:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:banking_virtual_account_management:14.3.0:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:banking_virtual_account_management:14.5.0:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:business_activity_monitoring:11.1.1.9.0:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:business_activity_monitoring:12.2.1.3.0:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:business_activity_monitoring:12.2.1.4.0:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:communications_brm_-_elastic_charging_engine:12.0.0.3:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:communications_policy_management:12.5.0:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.2:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.4:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.5:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.0:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.1:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0.6:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0.4:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:retail_xstore_point_of_service:18.0.3:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:retail_xstore_point_of_service:19.0.2:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:webcenter_portal:11.1.1.9.0:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0:*:*:*:*:*:*:*:
- cpe:2.3:a:xstream_project:xstream:*:*:*:*:*:*:*:*:
No vendor comments have been submitted for this CVE
Social Mentions
| Source | Title | Posted (UTC) |
|---|---|---|
 /r/AJsBotPlayground |
[CRITICAL] CVE Report on March 10, 2023 12:14 | 2023-03-10 12:14:48 |
| /r/AJsBotPlayground |
[CRITICAL] CVE Report on March 10, 2023 11:59 | 2023-03-10 11:59:25 |