CVE-2021-39144

Katalog CVE

CVSS 8.5 · High KEV · sudah dieksploitasi EPSS 98,1%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada xstream, debian linux +13 lainnya. Skor CVSS 3.1 8.5 (High) menurut NVD. Masuk katalog KEV CISA pada 10 Maret 2023, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.

Rincian

Terbit di NVD

23 Agustus 2021

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-94: Improper Control of Generation of Code ('Code Injection')
CWE-502: Deserialization of Untrusted Data
CWE-306: Missing Authentication for Critical Function

EPSS (30 hari)

98,1% peluang dieksploitasi; lebih tinggi dari 99,9% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

XStream Remote Code Execution Vulnerability

Masuk KEV

10 Maret 2023

Tenggat CISA

31 Maret 2023 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

Apply updates per vendor instructions.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/x-stream/xstream/security/advisories/GHSA-j9h8-phrw-h4fh advisory vendor
• https://x-stream.github.io/CVE-2021-39144.html exploit · advisory vendor
• https://www.oracle.com/security-alerts/cpuapr2022.html patch · advisory pihak ketiga
• https://www.oracle.com/security-alerts/cpujan2022.html patch · advisory pihak ketiga
• https://www.oracle.com/security-alerts/cpujul2022.html patch · advisory pihak ketiga
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-39144 pemerintah AS
• http://packetstormsecurity.com/files/169859/VMware-NSX-Manager-XStream-Unauthenticated-Remote-Code-Execution.h... exploit · advisory pihak ketiga · vdb entry
• https://lists.debian.org/debian-lts-announce/2021/09/msg00017.html mailing list · advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20210923-0003/ advisory pihak ketiga
• https://www.debian.org/security/2021/dsa-5004 advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3B... broken link · mailing list · release notes
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRS... broken link · mailing list · release notes
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OG... broken link · mailing list · release notes