NetSight
IP …
high7.5

CVE-2021-29505

XStream is software for serializing Java objects to XML and back again.

Impact

XStream is software for serializing Java objects to XML and back again. A vulnerability in XStream versions prior to 1.4.17 may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types is affected. The vulnerability is patched in version 1.4.17.

Affected products

VendorProductAffected versions
XstreamXstream
before 1.4.17
DebianDebian Linux
Versions 9.0, 10.0, 11.0
FedoraprojectFedora
Versions 33, 34, 35
NetappSnapmanager
All versions
OracleBanking Cash Management
Versions 14.2, 14.3, 14.5
OracleBanking Corporate Lending Process Management
Versions 14.2.0, 14.3.0, 14.5.0
OracleBanking Credit Facilities Process Management
Versions 14.2.0, 14.3.0, 14.5.0
OracleBanking Supply Chain Finance
Version 14.2.0
OracleBanking Trade Finance Process Management
Version 14.5.0
OracleBusiness Activity Monitoring
Versions 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0
OracleCommunications Brm - Elastic Charging Engine
Versions 11.3, 12.0
OracleCommunications Unified Inventory Management
Versions 7.3.4, 7.3.5, 7.4.0, 7.4.1, 7.4.2

Weakness classification

CWE-94CWE-502

References