NetSight
IP …
high8.5Known exploited

CVE-2021-39144

XStream is vulnerable to a Remote Command Execution attack

Exploited in the wild

This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2023-03-10. Federal due date: 2023-03-31.

Apply updates per vendor instructions.

Impact

### Impact The vulnerability may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. ### Patches XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose. ### Workarounds See [workarounds](https://x-stream.github.io/security.html#workaround) for the different versions covering all CVEs. ### References See full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for [CVE-2021-39144](https://x-stream.github.io/CVE-2021-39144.html). ### Credits Ceclin and YXXX from the Tencent Security Response Center found and reported the issue to XStream and provided the required information to reproduce it. ### For more information If you have any questions or comments about this advisory: * Open an issue in [XStream](https://github.com/x-stream/xstream/issues) * Email us at [XStream Google Group](https://groups.google.com/group/xstream-user)

Affected packages

EcosystemPackageAffectedFixed in
mavencom.thoughtworks.xstream:xstream< 1.4.181.4.18

Affected products

VendorProductAffected versions
XstreamXstream
before 1.4.18
DebianDebian Linux
Versions 9.0, 10.0, 11.0
FedoraprojectFedora
Versions 33, 34, 35
NetappSnapmanager
All versions
OracleBusiness Activity Monitoring
Version 12.2.1.4.0
OracleCommerce Guided Search
Version 11.3.2
OracleCommunications Billing And Revenue Management Elastic Charging Engine
Versions 11.3, 12.0
OracleCommunications Cloud Native Core Automated Test Suite
Version 1.9.0
OracleCommunications Cloud Native Core Binding Support Function
Version 1.10.0
OracleCommunications Cloud Native Core Policy
Version 1.14.0
OracleCommunications Unified Inventory Management
Versions 7.3.4, 7.3.5, 7.4.0, 7.4.1, 7.4.2
OracleRetail Xstore Point Of Service
Versions 16.0.6, 17.0.4, 18.0.3, 19.0.2, 20.0.1

Weakness classification

CWE-94CWE-502CWE-306

References