NetSight
IP …
high8.5

CVE-2021-39149

XStream is a simple library to serialize objects to XML and back again.

Impact

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.

Affected products

VendorProductAffected versions
XstreamXstream
before 1.4.18
FedoraprojectFedora
Versions 33, 34, 35
DebianDebian Linux
Versions 9.0, 10.0, 11.0
NetappSnapmanager
All versions
OracleBusiness Activity Monitoring
Version 12.2.1.4.0
OracleCommerce Guided Search
Version 11.3.2
OracleCommunications Billing And Revenue Management Elastic Charging Engine
Versions 11.3, 12.0
OracleCommunications Cloud Native Core Automated Test Suite
Version 1.9.0
OracleCommunications Cloud Native Core Binding Support Function
Version 1.10.0
OracleCommunications Cloud Native Core Policy
Version 1.14.0
OracleCommunications Unified Inventory Management
Versions 7.3.4, 7.3.5, 7.4.0, 7.4.1, 7.4.2
OracleRetail Xstore Point Of Service
Versions 16.0.6, 17.0.4, 18.0.3, 19.0.2, 20.0.1

Weakness classification

CWE-434CWE-502

References