CVE-2021-39146: xstream +14 lainnya

csirt@kutim:~/threat-intel/cve/CVE-2021-39146

CVSS 8.5 · High EPSS 14,3%

Kerentanan Unrestricted Upload of File with Dangerous Type pada xstream, fedoraproject fedora +13 lainnya. Skor CVSS 3.1 8.5 (High) menurut NVD.

Deskripsi (NVD)

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.

Rincian

Terbit di NVD: 23 Agustus 2021
Terakhir diubah: 7 Oktober 2026
Status NVD: Analyzed
CVSS 3.1: 8.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-434: Unrestricted Upload of File with Dangerous Type
CWE-502: Deserialization of Untrusted Data
EPSS (30 hari): 14,3% peluang dieksploitasi; lebih tinggi dari 96,5% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
xstream	xstream	Semua versi sebelum 1.4.18
fedoraproject	fedora	Versi 33
fedoraproject	fedora	Versi 34
fedoraproject	fedora	Versi 35
debian	debian linux	Versi 9.0
debian	debian linux	Versi 10.0
debian	debian linux	Versi 11.0
netapp	snapmanager	Semua versi
oracle	business activity monitoring	Versi 12.2.1.4.0
oracle	commerce guided search	Versi 11.3.2
oracle	communications billing and revenue management elastic charging engine	Versi 11.3
oracle	communications billing and revenue management elastic charging engine	Versi 12.0
oracle	communications cloud native core automated test suite	Versi 1.9.0
oracle	communications cloud native core binding support function	Versi 1.10.0
oracle	communications cloud native core policy	Versi 1.14.0
oracle	communications unified inventory management	Versi 7.3.4
oracle	communications unified inventory management	Versi 7.3.5
oracle	communications unified inventory management	Versi 7.4.0
oracle	communications unified inventory management	Versi 7.4.1
oracle	communications unified inventory management	Versi 7.4.2
oracle	retail xstore point of service	Versi 16.0.6
oracle	retail xstore point of service	Versi 17.0.2
oracle	retail xstore point of service	Versi 18.0.3
oracle	retail xstore point of service	Versi 19.0.2
oracle	retail xstore point of service	Versi 20.0.1
oracle	utilities framework	Versi 4.2.0.2.0
oracle	utilities framework	Versi 4.2.0.3.0
oracle	utilities framework	Versi 4.3.0.1.0
oracle	utilities framework	Versi 4.3.0.6.0
oracle	utilities framework	Versi 4.4.0.0.0
oracle	utilities framework	Versi 4.4.0.2.0
oracle	utilities framework	Versi 4.4.0.3.0
oracle	utilities testing accelerator	Versi 6.0.0.1.1
oracle	webcenter portal	Versi 12.2.1.3.0
oracle	webcenter portal	Versi 12.2.1.4.0

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://x-stream.github.io/CVE-2021-39146.html advisory vendor
https://www.oracle.com/security-alerts/cpuapr2022.html patch · advisory pihak ketiga
https://www.oracle.com/security-alerts/cpujan2022.html patch · advisory pihak ketiga
https://github.com/x-stream/xstream/security/advisories/GHSA-p8pq-r894-fm8f advisory pihak ketiga
https://lists.debian.org/debian-lts-announce/2021/09/msg00017.html mailing list · advisory pihak ketiga
https://security.netapp.com/advisory/ntap-20210923-0003/ advisory pihak ketiga
https://www.debian.org/security/2021/dsa-5004 advisory pihak ketiga
https://www.oracle.com/security-alerts/cpujul2022.html advisory pihak ketiga
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3B... mailing list
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRS... mailing list
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OG... mailing list

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 8 Okt 2026, 12:26 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.