NetSight
IP …
high8.5

CVE-2021-39153

XStream is a simple library to serialize objects to XML and back again.

Impact

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream, if using the version out of the box with Java runtime version 14 to 8 or with JavaFX installed. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.

Affected products

VendorProductAffected versions
XstreamXstream
before 1.4.18
FedoraprojectFedora
Versions 33, 34, 35
DebianDebian Linux
Versions 9.0, 10.0, 11.0
NetappSnapmanager
All versions
OracleBusiness Activity Monitoring
Version 12.2.1.4.0
OracleCommunications Billing And Revenue Management Elastic Charging Engine
Versions 11.3, 12.0
OracleCommunications Cloud Native Core Automated Test Suite
Version 1.9.0
OracleCommunications Cloud Native Core Binding Support Function
Version 1.10.0
OracleCommunications Cloud Native Core Policy
Version 1.14.0
OracleCommunications Unified Inventory Management
Versions 7.3.4, 7.3.5, 7.4.0, 7.4.1, 7.4.2
OracleUtilities Framework
Versions 4.2.0.2.0, 4.2.0.3.0, 4.3.0.1.0, 4.3.0.6.0, 4.4.0.0.0, 4.4.0.2.0
OracleUtilities Testing Accelerator
Version 6.0.0.1.1

Weakness classification

CWE-434CWE-502

References