Log in Start free

Vulnerability · Published Aug 23, 2021 · Assigned by GitHub_M

CVE-2021-39139XStream is vulnerable to an Arbitrary Code Execution attack

High 8.5

In plain English

A high-severity unsafe deserialization in xstream from x-stream. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 4.5% (higher than 92% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.5High
Exploit odds (30 days)4.5%top 8.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. A user is only affected if using the version out of the box with JDK 1.7u21 or below. However, this scenario can be adjusted easily to an external Xalan that works regardless of the version of the Java runtime. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12libxstream-java1.4.18-1DEBIAN-CVE-2021-39139
Debian:13libxstream-java1.4.18-1DEBIAN-CVE-2021-39139
Debian:14libxstream-java1.4.18-1DEBIAN-CVE-2021-39139
Mavencom.thoughtworks.xstream:xstream1.4.18GHSA-64xx-cq4q-mf44
Ubuntu:22.04:LTSlibxstream-java1.4.18-2ubuntu0.1USN-5946-1

Affected products (as reported)

VendorProductVersions
x-stream xstream < 1.4.18

Weakness: CWE-502, CWE-434 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

References