PT-2021-22399 · Xstream+6 · Xstream+6

Published 2021-08-23 · Updated 2023-03-13 · CVE-2021-39140

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions XStream versions prior to 1.4.18

Description The issue may allow a remote attacker to allocate 100% CPU time on the target system, depending on CPU type or parallel execution of a payload, resulting in a denial of service by manipulating the processed input stream. Users who set up XStream's security framework with a whitelist limited to the minimal required types are not affected.

Recommendations For versions prior to 1.4.18, setup XStream's security framework with a whitelist limited to the minimal required types to prevent exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Deserialization of Untrusted Data

Infinite Loop

Weakness Enumeration

CWE-502

CWE-835

Related Identifiers

ALT-PU-2022-7660

CVE-2021-39140

DLA-2769-1

DSA-5004-1

ELSA-2021-3956

GHSA-6WF9-JMG9-VXCC

MGASA-2021-0474

OESA-2021-1337

OPENSUSE-SU-2021:1401-1

OPENSUSE-SU-2021:3476-1

OPENSUSE-SU-2021_1401-1

OPENSUSE-SU-2021_3476-1

RHSA-2021:3956

RHSA-2021_3956

SUSE-SU-2021:3476-1

USN-5946-1

Affected Products

Alt Linux

Astra Linux

Linuxmint

Red Hat

Suse

Ubuntu

Xstream

References · 92

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/vmware_nsxmgr_xstream_rce_cve_2021_39144.rb · Exploit
• 🔥 https://github.com/jas502n/CVE-2020-26259 · Exploit
• 🔥 https://github.com/MyBlackManba/CVE-2021-29505 · Exploit
• 🔥 https://github.com/111ddea/Xstream_cve-2022-41966 · Exploit
• 🔥 https://github.com/Al1ex/CVE-2020-26259 · Exploit
• 🔥 https://x-stream.github.io/CVE-2021-39140.html · Exploit
• 🔥❌ https://github.com/b3wT/CVE-2021-39144-XSTREAM-RCE · Exploit, Deleted
• https://oracle.com/security-alerts/cpujan2022.html · Patch
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB · Vendor Advisory
• https://oracle.com/security-alerts/cpuapr2022.html · Patch
• https://ubuntu.com/security/CVE-2021-39146 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6wf9-jmg9-vxcc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-39144 · Security Note
• https://oracle.com/security-alerts/cpujul2022.html · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-39139 · Security Note