PT-2021-4766 · Xstream+5 · Xstream+5

Published 2021-03-12 · Updated 2024-08-22 · CVE-2021-21348

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions XStream versions prior to 1.4.16

Description The issue concerns a Java library used for serializing objects to XML and back. It may allow a remote attacker to occupy a thread, causing it to consume maximum CPU time and never return. Users who set up XStream's security framework with a limited whitelist are not affected. The vulnerability can be exploited to cause a denial of service by consuming maximum CPU time.

Recommendations To resolve the issue, use at least version 1.4.16 if you rely on XStream's default blacklist of the Security Framework. As a temporary workaround, consider setting up XStream's security framework with a whitelist limited to the minimal required types until a patch is applied.

Fix

Deserialization of Untrusted Data

Resource Exhaustion

Weakness Enumeration

CWE-502

CWE-400

Related Identifiers

ALT-PU-2022-1100

ALT-PU-2022-2171

ALT-PU-2022-7660

ALT-PU-2023-1912

BDU:2021-05485

BIT-ACTIVEMQ-2021-21348

CVE-2021-21348

DLA-2616-1

DSA-5004-1

GHSA-56P8-3FH9-4CVQ

MGASA-2021-0370

OESA-2021-1185

OPENSUSE-SU-2021:0832-1

OPENSUSE-SU-2021:1840-1

OPENSUSE-SU-2021_0832-1

OPENSUSE-SU-2021_1840-1

OPENSUSE-SU-2024:10592-1

SUSE-SU-2021:1840-1

SUSE-SU-2021:1840-2

USN-4943-1

USN-6978-1

Affected Products

Alt Linux

Astra Linux

Linuxmint

Suse

Ubuntu

Xstream

References · 123

• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4943-1 · Vendor Advisory
• https://debian.org/lts/security/2021/dla-2616 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-21346 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21341 · Security Note
• https://ubuntu.com/security/CVE-2021-21345 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-21347 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21351 · Security Note
• https://osv.dev/vulnerability/MGASA-2021-0370 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-21348 · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/683476 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-21348 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-21348 · Vendor Advisory