XStream 资源管理错误漏洞

🗓️ 29 Jan 2022 00:00:00Reported by China National Vulnerability Database of Information SecurityType

cnnvd

cnnvd🔗 www.cnnvd.org.cn👁 1 Views

XStream resource management error causes denial of service via CPU exhaustion from input streams; upgrade or enable no reference mode.

Reporter	Title	Published	Views	Family All 94
FreeBSD	jenkins -- DoS vulnerability in bundled XStream library	9 Feb 202200:00	–	freebsd
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in XStream	30 Mar 202215:22	–	ibm
IBM Security Bulletins	Security Bulletin: Atlas eDiscovery Process Management is affected by a vulnerable xstream-1.4.17.jar	8 May 202308:40	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Samba, OpenSSL, Python, and XStream affect IBM Spectrum Protect Plus (CVE-2021-20254, CVE-2021-3712, CVE-2021-43859, CVE-2022-0778, CVE-2020-25717, CVE-2021-23192, CVE-2021-3733)	30 Jun 202203:51	–	ibm
IBM Security Bulletins	Security Bulletin: IBM InfoSphere Information Server is affected by multiple vulnerabilities in XStream	27 Apr 202223:05	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Engineering Test Management is vulnerable to denial of service due to XStream (CVE-2021-43859)	2 May 202307:50	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Spectrum Control is vulnerable to multiple weaknesses related to XStream, Apache Xerces2, Jackson, OpenSSL, and Java SE	26 May 202207:31	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Data Risk Manager is affected by multiple vulnerabilities including a remote code execution in Spring Framework (CVE-2022-22965)	11 Apr 202215:17	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Golang Go, OpenSSL, Python, and XStream affect IBM Spectrum Copy Data Management	9 Jun 202217:55	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security Verify Governance is vulnerable to multiple security threats due to use of XStream	22 Nov 202216:29	–	ibm

Source	Link
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/XODFRE2ZL64FICBJDOPWOLPTSSAI4U7X/
lists	www.lists.debian.org/debian-lts-announce/2022/02/msg00018.html
github	www.github.com/x-stream/xstream/commit/e8e88621ba1c85ac3b8620337dd672e0c0c3a846
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/VACQYG356OHUTD5WQGAQ4L2TTFTAV3SJ/
oracle	www.oracle.com/security-alerts/cpuapr2022.html
github	www.github.com/x-stream/xstream/security/advisories/GHSA-rmr5-cpv2-vgjf
x-stream	www.x-stream.github.io/CVE-2021-43859.html
openwall	www.openwall.com/lists/oss-security/2022/02/09/1
oracle	www.oracle.com/security-alerts/cpujul2022.html
auscert	www.auscert.org.au/bulletins/ESB-2022.0673

23 May 2026 00:00Current

8.2High risk

Vulners AI Score8.2

CVSS 25

CVSS 3.17.5

EPSS0.01863

SSVC

xstream vulnerability resource management error denial of service cpu exhaustion input streams upgrade recommended no reference mode