8.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
6 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:S/C:P/I:P/A:P
0.025 Low
EPSS
Percentile
89.8%
The vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream, if using the version out of the box with Java runtime version 14 to 8 or with JavaFX installed. No user is affected, who followed the recommendation to setup XStream’s security framework with a whitelist limited to the minimal required types.
XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.
See workarounds for the different versions covering all CVEs.
See full information about the nature of the vulnerability and the steps to reproduce it in XStream’s documentation for CVE-2021-39153.
Ceclin and YXXX from the Tencent Security Response Center found and reported the issue to XStream and provided the required information to reproduce it.
If you have any questions or comments about this advisory:
CPE | Name | Operator | Version |
---|---|---|---|
com.thoughtworks.xstream:xstream | lt | 1.4.18 |
github.com/advisories/GHSA-2q8x-2p7f-574v
github.com/x-stream/xstream/security/advisories/GHSA-2q8x-2p7f-574v
lists.debian.org/debian-lts-announce/2021/09/msg00017.html
lists.fedoraproject.org/archives/list/[email protected]/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/
lists.fedoraproject.org/archives/list/[email protected]/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/
lists.fedoraproject.org/archives/list/[email protected]/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/
nvd.nist.gov/vuln/detail/CVE-2021-39153
security.netapp.com/advisory/ntap-20210923-0003/
www.debian.org/security/2021/dsa-5004
www.oracle.com/security-alerts/cpuapr2022.html
www.oracle.com/security-alerts/cpujan2022.html
www.oracle.com/security-alerts/cpujul2022.html
x-stream.github.io/CVE-2021-39153.html
8.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
6 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:S/C:P/I:P/A:P
0.025 Low
EPSS
Percentile
89.8%