QID 353077

a flaw was found in xstream, a simple library used to serialize objects to xml and back again.
This flaw allows a remote attacker to load and execute arbitrary code from a remote host by manipulating the processed input stream.
The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. (
( CVE-2021-39139) xstream is a simple library to serialize objects to xml and back again.
In affected versions this vulnerability may allow a remote attacker to allocate 100% cpu time on the target system depending on cpu type or parallel execution of such a payload resulting in a denial of service only by manipulating the processed input stream.
No user is affected, who followed the recommendation to setup xstreams security framework with a whitelist limited to the minimal required types.
Xstream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose. (
( CVE-2021-39140) a flaw was found in xstream, a simple library used to serialize objects to xml and back again.
( CVE-2021-39141) (cve-2021-39144) (cve-2021-39145) (cve-2021-39146) (cve-2021-39147) (cve-2021-39148) (cve-2021-39149) (cve-2021-39151) (cve-2021-39153) (cve-2021-39154) a flaw was found in xstream, a simple library used to serialize objects to xml and back again.
This flaw allows a remote attacker to request data from internal resources that are not publicly available by manipulating the processed input stream with java runtime versions 14 to 8.
( CVE-2021-39150) (cve-2021-39152)

Successful exploitation of this vulnerability could lead to a securitybreach or could affect integrity, availability, and confidentiality.