CVE-2021-43859: jenkins +10 lainnya

csirt@kutim:~/threat-intel/cve/CVE-2021-43859

CVSS 7.5 · High EPSS 7,9%

Kerentanan Uncontrolled Resource Consumption pada jenkins, xstream +9 lainnya. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

XStream is an open source java library to serialize objects to XML and back again. Versions prior to 1.4.19 may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a payload resulting in a denial of service only by manipulating the processed input stream. XStream 1.4.19 monitors and accumulates the time it takes to add elements to collections and throws an exception if a set threshold is exceeded. Users are advised to upgrade as soon as possible. Users unable to upgrade may set the NO_REFERENCE mode to prevent recursion. See GHSA-rmr5-cpv2-vgjf for further details on a workaround if an upgrade is not possible.

Rincian

Terbit di NVD: 1 Februari 2022
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-400: Uncontrolled Resource Consumption
EPSS (30 hari): 7,9% peluang dieksploitasi; lebih tinggi dari 94,6% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
jenkins	jenkins	Semua versi sebelum 2.319.3
jenkins	jenkins	Versi 2.321 hingga sebelum 2.334
xstream	xstream	Semua versi sebelum 1.4.19
fedoraproject	fedora	Versi 34
fedoraproject	fedora	Versi 35
debian	debian linux	Versi 9.0
oracle	commerce guided search	Versi 11.3.2
oracle	communications brm - elastic charging engine	Semua versi sebelum 12.0.0.4.6
oracle	communications brm - elastic charging engine	Versi 12.0.0.5.0
oracle	communications cloud native core automated test suite	Versi 1.9.0
oracle	communications diameter intelligence hub	Versi 8.0.0 hingga 8.1.0
oracle	communications diameter intelligence hub	Versi 8.2.0 hingga 8.2.6
oracle	communications policy management	Versi 12.6.0.0.0
oracle	flexcube private banking	Versi 12.1.0
oracle	retail xstore point of service	Versi 16.0.6
oracle	retail xstore point of service	Versi 17.0.4
oracle	retail xstore point of service	Versi 18.0.3
oracle	retail xstore point of service	Versi 19.0.2
oracle	retail xstore point of service	Versi 20.0.1

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://x-stream.github.io/CVE-2021-43859.html exploit · advisory vendor
https://github.com/x-stream/xstream/commit/e8e88621ba1c85ac3b8620337dd672e0c0c3a846 patch · advisory pihak ketiga
https://www.oracle.com/security-alerts/cpuapr2022.html patch · advisory pihak ketiga
https://www.oracle.com/security-alerts/cpujul2022.html patch · advisory pihak ketiga
http://www.openwall.com/lists/oss-security/2022/02/09/1 mailing list · advisory pihak ketiga
https://github.com/x-stream/xstream/security/advisories/GHSA-rmr5-cpv2-vgjf exploit · advisory pihak ketiga
https://lists.debian.org/debian-lts-announce/2022/02/msg00018.html mailing list · advisory pihak ketiga
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VACQYG356OHUT... mailing list
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XODFRE2ZL64FI... mailing list
https://lists.debian.org/debian-lts-announce/2024/12/msg00023.html

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.