XStream: remote command execution attack by manipulating the processed input stream

A flaw was found in XStream. By manipulating the processed input stream, a remote attacker may be able to obtain sufficient rights to execute commands. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...

Scientific Linux Security Update : xstream on SL7.x (noarch) (2021:2683)

The remote Scientific Linux 7 host has packages installed that are affected by a vulnerability as referenced in the SLSA-2021:2683-1 advisory. - XStream: remote command execution attack by manipulating the processed input stream CVE-2021-29505 Note that Nessus has not tested for this issue but ha...

RHEL 7 : xstream (RHSA-2021:2683)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:2683 advisory. XStream is a Java XML serialization library to serialize objects to and deserialize object from XML. Security Fixes: XStream: remote command executio...

Oracle Linux 7 : xstream (ELSA-2021-2683)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2021-2683 advisory. 1.3.1-14 - Fix remote code execution vulnerability - Resolves: CVE-2021-29505 Tenable has extracted the preceding description block directly from the Oracle Lin...

OPENSUSE-SU-2021:1995-1 Security update for xstream

This update for xstream fixes the following issues: Upgrade to 1.4.17 - CVE-2021-29505: Fixed potential code execution when unmarshalling with XStream instances using an uninitialized security framework bsc1186651...

OPENSUSE-SU-2021:1840-1 Security update for xstream

This update for xstream fixes the following issues: - Upgrade to 1.4.16 - CVE-2021-21351: remote attacker to load and execute arbitrary code bsc1184796 - CVE-2021-21349: SSRF can lead to a remote attacker to request data from internal resources bsc1184797 - CVE-2021-21350: arbitrary code executio...

SUSE-SU-2021:1840-2 Security update for xstream

This update for xstream fixes the following issues: - Upgrade to 1.4.16 - CVE-2021-21351: remote attacker to load and execute arbitrary code bsc1184796 - CVE-2021-21349: SSRF can lead to a remote attacker to request data from internal resources bsc1184797 - CVE-2021-21350: arbitrary code executio...

Security update for xstream (important)

openSUSE Security Update: Security update for xstream Announcement ID: openSUSE-SU-2021:1840-1 Rating: important References: 1184372 1184373 1184374 1184375 1184376 1184377 1184378 1184379 1184380 1184796 1184797 Cross-References: CVE-2021-21341 CVE-2021-21342 CVE-2021-21343 CVE-2021-21344...

Security update for xstream (important)

openSUSE Security Update: Security update for xstream Announcement ID: openSUSE-SU-2021:1995-1 Rating: important References: 1186651 Cross-References: CVE-2021-29505 CVSS scores: CVE-2021-29505 NVD : 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-29505 SUSE: 8.1...

Security Bulletin: IBM InfoSphere Information Server is affected by multiple vulnerabilities in XStream

Summary Multiple vulnerabilities in XStream that is used by IBM InfoSphere Information Server were addressed. Vulnerability Details CVEID: CVE-2021-21342 DESCRIPTION: XStream is vulnerable to server-side request forgery, caused by a flaw when processing stream at unmarshalling time. By manipulati...

Debian: Security Advisory (DLA-2704-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 2704-1] libxstream-java security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2704-1 [email protected] https://www.debian.org/lts/security/ Sylvain Beucler July 05, 2021 https://wiki.debian.org/LTS -...

Security Bulletin: Vulnerabilities in MongoDB, Node.js, Docker, and XStream affect IBM Spectrum Protect Plus

Summary IBM Spectrum Protect Plus may be affected by vulnerabilities in MongoDB, Node.js, Docker, and XStream such as server-side request forgery, bypass of security restrictions, denial of service, execution of arbitrary code, elevation of privileges, and arbitrary file deletion. Vulnerability...

openSUSE 15 Security Update : xstream (openSUSE-SU-2021:0911-1)

The remote SUSE Linux SUSE15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE-SU-2021:0911-1 advisory. - XStream is software for serializing Java objects to XML and back again. A vulnerability in XStream versions prior to 1.4.17 may allow a remote...

openSUSE: Security Advisory for xstream (openSUSE-SU-2021:0911-1)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Vulnerability fixed in XStream

A vulnerability has been fixed in XStream. An authenticated malicious party could potentially exploit the vulnerability to execute arbitrary code under application privileges. To do this, a rogue XML file needs to be presented to the application presented. The developers have released updates to...

OPENSUSE-SU-2021:0911-1 Security update for xstream

This update for xstream fixes the following issues: Upgrade to 1.4.17 - CVE-2021-29505: Fixed potential code execution when unmarshalling with XStream instances using an uninitialized security framework bsc1186651 This update was imported from the SUSE:SLE-15-SP2:Update update project...

Security update for xstream (important)

openSUSE Security Update: Security update for xstream Announcement ID: openSUSE-SU-2021:0911-1 Rating: important References: 1186651 Cross-References: CVE-2021-29505 CVSS scores: CVE-2021-29505 NVD : 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-29505 SUSE: 8.1...

The vulnerability of the Xstream Java library for converting objects to XML or JSON format arises from the lack of measures taken to eliminate special elements used in operating system commands. This allows attackers to delete any known files on the host.

The vulnerability of the Java library for converting objects to XML or JSON format, Xstream, exists because measures to neutralize special elements used in the operating system command are not taken. Exploiting this vulnerability can allow a malicious actor to delete any known files on the host...

The vulnerability of the Xstream Java library for converting objects into XML or JSON format lies in insufficient validation of incoming requests. This allows attackers to retrieve data from internal resources that are not publicly accessible.

The vulnerability of the Xstream library for converting objects into XML or JSON format is related to insufficient checking of incoming requests. Exploiting this vulnerability allows a malicious actor to request data from internal resources that are not publicly accessible, as a result of...