CVE-2021-21345mediumCWE-502CWE-94

CVE-2021-21345: medium-severity vulnerability in x-stream xstream

XStream is vulnerable to a Remote Command Execution attack

Published · Updated

Follow this CVE+ Monitor xstream+ Monitor libxstream-java

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

50Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendcvss 5.8epss 72%
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Affected
10 products
Red Hat BPM Suite 6 · Red Hat Integration Camel K 1 · Red Hat JBoss A-MQ 6 · Red Hat JBoss BRMS 5 · Red Hat JBoss BRMS 6 · and others 5
no_fix_planned: Out of support scope
Fixed
10 products (18 components)
Red Hat Enterprise Linux Client Optional (v. 7) · Red Hat Enterprise Linux ComputeNode Optional (v. 7) · Red Hat Enterprise Linux Server Optional (v. 7) · Red Hat Enterprise Linux Workstation Optional (v. 7) · RHDM 7.11.0 · and others 5
fix ↗
Not affected
3 products (5 components) — because the vulnerable code is not present in the product
Red Hat OpenShift Container Platform 3.11 · Red Hat OpenShift Container Platform 4 · Red Hat Integration Camel Quarkus 1
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker who has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:N
Affected products
x-stream · xstream
Related CVEs — x-stream xstream

In the same product, most dangerous first.

CVE-2021-39144HIGHXStream is vulnerable to a Remote Command Execution attackEPSS 98.1%KEVCVE-2020-26217HIGHRemote Code Execution in XStreamEPSS 85.0%CVE-2020-26259MEDIUMXStream is vulnerable to an Arbitrary File Deletion on the local host when unmarshallingEPSS 82.4%CVE-2021-21351MEDIUMXStream is vulnerable to an Arbitrary Code Execution attackEPSS 82.1%CVE-2020-26258MEDIUMServer-Side Forgery Request can be activated unmarshalling with XStreamEPSS 81.8%CVE-2021-21341HIGHXStream can cause a Denial of ServiceEPSS 77.8%