PT-2021-14435 · Xstream+5 · Xstream+5

Published 2021-03-16 · Updated 2024-08-22 · CVE-2021-21341

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions XStream versions prior to 1.4.16

Description The issue allows a remote attacker to allocate 100% CPU time on the target system, depending on CPU type or parallel execution of a payload, resulting in a denial of service by manipulating the processed input stream. Users who set up XStream's security framework with a whitelist limited to the minimal required types are not affected.

Recommendations To resolve the issue, use at least version 1.4.16 if you rely on XStream's default blacklist of the Security Framework. As a temporary workaround, consider setting up XStream's security framework with a whitelist limited to the minimal required types until a patch is applied.

Exploit

Fix

DoS

Deserialization of Untrusted Data

Infinite Loop

Resource Exhaustion

Weakness Enumeration

CWE-502

CWE-835

CWE-400

Related Identifiers

ALT-PU-2022-7660

BIT-ACTIVEMQ-2021-21341

CVE-2021-21341

DLA-2616-1

DSA-5004-1

GHSA-2P3X-QW9C-25HH

MGASA-2021-0370

OESA-2021-1185

OPENSUSE-SU-2021:0832-1

OPENSUSE-SU-2021:1840-1

OPENSUSE-SU-2021_0832-1

OPENSUSE-SU-2021_1840-1

OPENSUSE-SU-2024:10592-1

SUSE-SU-2021:1840-1

SUSE-SU-2021:1840-2

SUSE-SU-2021_1840-1

USN-4943-1

USN-6978-1

Affected Products

Alt Linux

Astra Linux

Linuxmint

Suse

Ubuntu

Xstream

References · 118

• 🔥 https://x-stream.github.io/CVE-2021-21341.html · Exploit
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4943-1 · Vendor Advisory
• https://debian.org/lts/security/2021/dla-2616 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-21346 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21341 · Security Note
• https://ubuntu.com/security/CVE-2021-21345 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-21347 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21351 · Security Note
• https://cve.org/CVERecord?id=CVE-2021-21341 · Security Note
• https://osv.dev/vulnerability/MGASA-2021-0370 · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/683476 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-21343 · Security Note