XStream is vulnerable to an Arbitrary Code Execution attack

🗓️ 25 Aug 2021 14:46:49Reported by GitHub Advisory DatabaseType

github

github🔗 github.com👁 53 Views

XStream vulnerability to Arbitrary Code Executio

Reporter	Title	Published	Views	Family All 119
IBM Security Bulletins	Security Bulletin: Vulnerabilities in XStream affect IBM Spectrum Copy Data Management	11 Dec 202100:37	–	ibm
IBM Security Bulletins	Security Bulletin: Atlas eDiscovery Process Management is affected by a vulnerable xstream-1.4.17.jar	8 May 202308:40	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in XStream affect IBM Spectrum Protect Plus	10 Dec 202120:38	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in XStream	1 Oct 202106:19	–	ibm
IBM Security Bulletins	Security Bulletin: IBM InfoSphere Information Server is affected by multiple vulnerabilities in XStream	27 Apr 202223:05	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Spectrum Control is vulnerable to multiple weaknesses related to XStream, Apache Xerces2, Jackson, OpenSSL, and Java SE	26 May 202207:31	–	ibm
IBM Security Bulletins	Security Bulletin: Due to use of XStream, IBM Tivoli Netcool Configuration Manager is vulnerable to arbitrary code execution attack	24 Jan 202314:30	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in xstream-1.4.9.jar	29 Jan 202517:24	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Data Risk Manager is affected by multiple vulnerabilities including a remote code execution in Spring Framework (CVE-2022-22965)	11 Apr 202215:17	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security Verify Governance is vulnerable to multiple security threats due to use of XStream	22 Nov 202216:29	–	ibm

Vulners

Node

com.thoughtworks.xstream xstreamRange<1.4.18maven

Source	Link
github	www.github.com/x-stream/xstream/security/advisories/GHSA-2q8x-2p7f-574v
nvd	www.nvd.nist.gov/vuln/detail/CVE-2021-39153
x-stream	www.x-stream.github.io/CVE-2021-39153.html
security	www.security.netapp.com/advisory/ntap-20210923-0003/
lists	www.lists.debian.org/debian-lts-announce/2021/09/msg00017.html
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/
debian	www.debian.org/security/2021/dsa-5004
oracle	www.oracle.com/security-alerts/cpujan2022.html

27 Jan 2023 05:02Current

8.8High risk

Vulners AI Score8.8

CVSS 26

CVSS 3.18.5

EPSS0.00625

xstream arbitrary code execution vulnerability remote attack java runtime javafx security framework patches workarounds cve-2021-39153 documentation credit xstream google group