PT-2021-6076 · Oracle+7 · Jdk+7
Published
2021-08-23
·
Updated
2024-06-15
·
CVE-2021-39139
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
XStream versions prior to 1.4.18
Description
The issue is related to the deserialization mechanism in XStream, a library used to serialize objects to XML and back again. This may allow a remote attacker to load and execute arbitrary code from a remote host by manipulating the processed input stream. A user is only affected if using the version out of the box with JDK 1.7u21 or below. However, this scenario can be adjusted easily to an external Xalan that works regardless of the version of the Java runtime. No user is affected who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types.
Recommendations
For versions prior to 1.4.18, consider setting up XStream's security framework with a whitelist limited to the minimal required types to mitigate the risk.
As a temporary workaround, consider disabling the use of XStream with JDK 1.7u21 or below until a patch is available.
Restrict access to external Xalan to minimize the risk of exploitation.
Update to version 1.4.18 or later, which uses a whitelist by default and is more secure for general purpose.
Exploit
Fix
Deserialization of Untrusted Data
Unrestricted File Upload
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Jdk
Linuxmint
Red Hat
Suse
Ubuntu
Xalan