CVE-2021-39139

Katalog CVE

CVSS 8.8 · High EPSS 4,5%

Kerentanan Unrestricted Upload of File with Dangerous Type pada xstream, debian linux +13 lainnya. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. A user is only affected if using the version out of the box with JDK 1.7u21 or below. However, this scenario can be adjusted easily to an external Xalan that works regardless of the version of the Java runtime. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.

Rincian

Terbit di NVD

23 Agustus 2021

Terakhir diubah

7 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-434: Unrestricted Upload of File with Dangerous Type
CWE-502: Deserialization of Untrusted Data

EPSS (30 hari)

4,5% peluang dieksploitasi; lebih tinggi dari 91,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://x-stream.github.io/CVE-2021-39139.html advisory vendor
• https://www.oracle.com/security-alerts/cpuapr2022.html patch · advisory pihak ketiga
• https://www.oracle.com/security-alerts/cpujan2022.html patch · advisory pihak ketiga
• https://www.oracle.com/security-alerts/cpujul2022.html patch · advisory pihak ketiga
• https://github.com/x-stream/xstream/security/advisories/GHSA-64xx-cq4q-mf44 advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2021/09/msg00017.html mailing list · advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20210923-0003/ advisory pihak ketiga
• https://www.debian.org/security/2021/dsa-5004 advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3B... mailing list
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRS... mailing list
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OG... mailing list