PT-2021-22409 · Xstream+6 · Xstream+6

Zacharias Pigadas · Published 2021-08-23 · Updated 2026-02-16 · CVE-2021-39152

Positive Technologies (AI Summary)

CVSS v3.1

8.5

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions XStream versions prior to 1.4.18

Description XStream is a simple library to serialize objects to XML and back again. In affected versions, this issue may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream with a Java runtime version 14 to 8. No user is affected who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types.

Recommendations To resolve the issue, use at least version 1.4.18 if you rely on XStream's default blacklist of the Security Framework. As a temporary workaround, consider setting up XStream's security framework with a whitelist limited to the minimal required types.

Exploit

Fix

SSRF

Deserialization of Untrusted Data

Weakness Enumeration

CWE-918

CWE-502

Related Identifiers

ALT-PU-2022-7660

CVE-2021-39152

DLA-2769-1

DSA-5004-1

ELSA-2021-3956

GHSA-XW4P-CRPJ-VJX2

MGASA-2021-0474

OESA-2021-1337

OPENSUSE-SU-2021:1401-1

OPENSUSE-SU-2021:3476-1

OPENSUSE-SU-2021_1401-1

OPENSUSE-SU-2021_3476-1

RHSA-2021:3956

RHSA-2021_3956

SUSE-SU-2021:3476-1

USN-5946-1

Affected Products

Alt Linux

Astra Linux

Linuxmint

Red Hat

Suse

Ubuntu

Xstream

References · 89

• 🔥 https://x-stream.github.io/CVE-2021-39152.html · Exploit
• https://oracle.com/security-alerts/cpujan2022.html · Patch
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB · Vendor Advisory
• https://oracle.com/security-alerts/cpuapr2022.html · Patch
• https://ubuntu.com/security/CVE-2021-39146 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-39144 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-39139 · Security Note
• https://ubuntu.com/security/CVE-2021-39139 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5946-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-39148 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-39152 · Security Note
• https://debian.org/security/2021/dsa-5004 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-39145 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-39152 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-39152 · Vendor Advisory