CVE-2021-21349

XStream is a Java library to serialize objects to XML and back again. In
XStream before version 1.4.16, there is a vulnerability which may allow a
remote attacker to request data from internal resources that are not
publicly available only by manipulating the processed input stream. No user
is affected, who followed the recommendation to setup XStream’s security
framework with a whitelist limited to the minimal required types. If you
rely on XStream’s default blacklist of the Security Framework, you will
have to use at least version 1.4.16.

Bugs

• <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=985843&gt;