PT-2021-22401 · Xstream+6 · Xstream+6
CVE-2021-39145
·
Published
2021-08-23
·
Updated
2023-03-13
CVSS v3.1
8.5
High
| Vector | AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
XStream versions prior to 1.4.18
Description
The issue allows a remote attacker to load and execute arbitrary code from a remote host by manipulating the processed input stream. This can be done when using affected versions of XStream, a library to serialize objects to XML and back again. Users who set up XStream's security framework with a whitelist limited to the minimal required types are not affected.
Recommendations
For versions prior to 1.4.18, update to version 1.4.18 or later, which uses a whitelist by default instead of a blacklist, to prevent the execution of arbitrary code. As a temporary workaround, consider setting up XStream's security framework with a whitelist limited to the minimal required types to minimize the risk of exploitation.
Exploit
Fix
Deserialization of Untrusted Data
Unrestricted File Upload
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Linuxmint
Red Hat
Suse
Ubuntu
Xstream