CVE-2021-21341

2021-03-2300:15:12

Google

osv.dev

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7.1 High

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:N/I:N/A:C

0.011 Low

EPSS

Percentile

84.0%

JSON

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is vulnerability which may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a payload resulting in a denial of service only by manipulating the processed input stream. No user is affected who followed the recommendation to setup XStream’s security framework with a whitelist limited to the minimal required types. If you rely on XStream’s default blacklist of the Security Framework, you will have to use at least version 1.4.16.

CPENameOperatorVersion
xstreameqXSTREAM_1_4_11_1
xstreameqXSTREAM_1_4_13
xstreameqXSTREAM_1_4_5
xstreameqXSTREAM_1_4_12
xstreameqXSTREAM_1_4_15
xstreameqXSTREAM_1_4_9
xstreameqXSTREAM_1_4_14
xstreameqXSTREAM_1_4_10
xstreameqXSTREAM_1_4_11

Name	Operator	Version
xstream	eq	XSTREAM_1_4_11_1
xstream	eq	XSTREAM_1_4_13
xstream	eq	XSTREAM_1_4_5
xstream	eq	XSTREAM_1_4_12
xstream	eq	XSTREAM_1_4_15
xstream	eq	XSTREAM_1_4_9
xstream	eq	XSTREAM_1_4_14
xstream	eq	XSTREAM_1_4_10
xstream	eq	XSTREAM_1_4_11