CVE-2021-21348

Katalog CVE

CVSS 7.5 · High EPSS 13,8%

Kerentanan Uncontrolled Resource Consumption pada netapp oncommand insight, apache activemq +14 lainnya. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to occupy a thread that consumes maximum CPU time and will never return. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.

Rincian

Terbit di NVD

23 Maret 2021

Terakhir diubah

7 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-400: Uncontrolled Resource Consumption
CWE-502: Deserialization of Untrusted Data

EPSS (30 hari)

13,8% peluang dieksploitasi; lebih tinggi dari 96,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.oracle.com/security-alerts/cpujan2022.html patch · advisory vendor
• https://x-stream.github.io/security.html#workaround mitigasi · advisory pihak ketiga
• http://x-stream.github.io/changes.html#1.4.16 release notes · advisory pihak ketiga
• https://github.com/x-stream/xstream/security/advisories/GHSA-56p8-3fh9-4cvq advisory pihak ketiga
• https://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae655414d23ed0dd%40%3Cusers.acti... issue tracking · mailing list · advisory pihak ketiga
• https://lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fac48b425c6e16b0%40%3Cdev.jmeter... issue tracking · mailing list · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2021/04/msg00002.html mailing list · advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3B... mailing list · advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRS... mailing list · advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OG... mailing list · advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20210430-0002/ advisory pihak ketiga
• https://www.debian.org/security/2021/dsa-5004 mailing list · advisory pihak ketiga
• https://www.oracle.com//security-alerts/cpujul2021.html advisory pihak ketiga
• https://www.oracle.com/security-alerts/cpuoct2021.html advisory pihak ketiga
• https://x-stream.github.io/CVE-2021-21348.html advisory pihak ketiga