Remote Code Execution in XStream
58Vexday Risk Score
Patch soon. It has a working public exploit.
ssvc Attendcvss 8epss 85%
exploitation probability
85%top 1% of all CVEs
observed exploitation
nono source reports it
What the vendors declare (VEX)
Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.
Red HatVEX document ↗
Affected
6 products
Red Hat BPM Suite 6 · Red Hat Integration Camel K 1 · Red Hat Integration Camel Quarkus 1 · Red Hat JBoss BRMS 6 · Red Hat JBoss Data Grid 7 · and others 1
workaround: Depending on the version of XStream used there are various usage patterns that mitigate this flaw, though we would strongly recommend using the allow list approach if at all possible as there are likely more class combinations the deny list…
Fixed
11 products (19 components)
Red Hat Enterprise Linux Client Optional (v. 7) · Red Hat Enterprise Linux ComputeNode Optional (v. 7) · Red Hat Enterprise Linux Server Optional (v. 7) · Red Hat Enterprise Linux Workstation Optional (v. 7) · RHDM 7.9.1 · and others 6
Not affected
2 products (4 components) — because the vulnerable code is not present in the product
Red Hat OpenShift Container Platform 3.11 · Red Hat OpenShift Container Platform 4
XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream. Only users who rely on blocklists are affected. Anyone using XStream's Security Framework allowlist is not affected. The linked advisory provides code workarounds for users who cannot upgrade. The issue is fixed in version 1.4.14.
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
Affected products
x-stream · xstreamReferences
https://github.com/x-stream/xstream/commit/0fec095d534126931c99fd38e9c6d41f5c685c1ahttps://github.com/x-stream/xstream/security/advisories/GHSA-mw36-7c6c-q4q2https://lists.apache.org/thread.html/r2de526726e7f4db4a7cb91b7355070779f51a84fd985c6529c2f4e9e%40%3Cissues.activemq.apache.org%3Ehttps://lists.apache.org/thread.html/r7c9fc255edc0b9cd9567093d131f6d33fde4c662aaf912460ef630e9%40%3Ccommits.camel.apache.org%3Ehttps://lists.apache.org/thread.html/r826a006fda71cc96fc87b6eca4b5d195f19a292ad36cea501682c38c%40%3Cissues.activemq.apache.org%3Ehttps://lists.apache.org/thread.html/redde3609b89b2a4ff18b536a06ef9a77deb93d47fda8ed28086fa8c3%40%3Cissues.activemq.apache.org%3Ehttps://lists.debian.org/debian-lts-announce/2020/12/msg00001.htmlhttps://security.netapp.com/advisory/ntap-20210409-0004/https://www.debian.org/security/2020/dsa-4811https://www.oracle.com/security-alerts/cpuApr2021.htmlhttps://www.oracle.com/security-alerts/cpuapr2022.htmlhttps://www.oracle.com/security-alerts/cpujan2022.html