CVE-2021-21341

CVE-2021-21341 XStream 拒绝服务 XStream 官方公告 CVE-2021-21341 漏洞 CVE-2021-21341: XStream 可能导致拒绝服务。 受影响版本 如果直接使用默认配置，所有直至并包括 1.4.15 的版本均受影响。遵循建议使用白名单（仅包含最小必需类型）配置 XStream 安全框架的用户不受影响。 描述 在反序列化时，被处理的流包含用于重新创建先前写入对象的类型信息。因此，XStream 会基于这些类型信息创建新实例。攻击者可以操纵被处理的输入流，并替换或注入一个被操纵的...

Remote Code Execution (RCE)

org.apache.eventmesh:eventmesh-connector-rabbitmq is vulnerable to Remote Code Execution RCE. The vulnerability is due to blindly reading a ByteArrayInputStream without sanitization in getFromByteArray, which allows an attacker to execute malicious code on the system via rabbitmq messages...

XStream 代码问题漏洞

XStream is a simple Java-based library , Java objects serialized to xml and vice versa i.e. : Java objects and xml documents can easily be converted to each other . XStream has a denial-of-service vulnerability that can be exploited by an attacker to manipulate a processed input stream and replac...