Multiple vulnerabilities in XStream
| Risk | High |
| Patch available | YES |
| Number of vulnerabilities | 11 |
| CVE-ID | CVE-2021-21344 CVE-2021-21349 CVE-2021-21351 CVE-2021-21341 CVE-2021-21342 CVE-2021-21343 CVE-2021-21348 CVE-2021-21350 CVE-2021-21347 CVE-2021-21346 CVE-2021-21345 |
| CWE-ID | CWE-502 CWE-400 |
| Exploitation vector | Network |
| Public exploit | Public exploit code for vulnerability #2 is available. |
| Vulnerable software Subscribe |
xstream Universal components / Libraries / Libraries used by multiple products |
| Vendor | XStream |
Security Bulletin
This security bulletin contains information about 11 vulnerabilities.
1) Deserialization of Untrusted Data
EUVDB-ID: #VU52561
Risk: High
CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2021-21344
CWE-ID:
CWE-502 - Deserialization of Untrusted Data
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to insecure input validation when processing serialized data. A remote attacker can pass specially crafted data to the application and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsxstream: 0.2 - 1.4.15
External linkshttp://x-stream.github.io/changes.html#1.4.16
http://github.com/x-stream/xstream/security/advisories/GHSA-59jw-jqf4-3wq3
http://lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fac48b425c6e16b0@%3Cdev.jmeter.apache.org%3E
http://lists.debian.org/debian-lts-announce/2021/04/msg00002.html
http://x-stream.github.io/CVE-2021-21344.html
http://x-stream.github.io/security.html#workaround
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Deserialization of Untrusted Data
EUVDB-ID: #VU52572
Risk: Medium
CVSSv3.1: 6.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C]
CVE-ID: CVE-2021-21349
CWE-ID:
CWE-502 - Deserialization of Untrusted Data
Exploit availability: Yes
DescriptionThe vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to insecure input validation when processing serialized data. A remote attacker can pass specially crafted data to the application and gain access to sensitive information.
Install updates from vendor's website.
Vulnerable software versionsxstream: 0.2 - 1.4.15
External linkshttp://x-stream.github.io/changes.html#1.4.16
http://github.com/x-stream/xstream/security/advisories/GHSA-f6hm-88x3-mfjv
http://lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fac48b425c6e16b0@%3Cdev.jmeter.apache.org%3E
http://lists.debian.org/debian-lts-announce/2021/04/msg00002.html
http://x-stream.github.io/CVE-2021-21349.html
http://x-stream.github.io/security.html#workaround
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.
3) Deserialization of Untrusted Data
EUVDB-ID: #VU52571
Risk: High
CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2021-21351
CWE-ID:
CWE-502 - Deserialization of Untrusted Data
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to insecure input validation when processing serialized data. A remote attacker can pass specially crafted data to the application and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsxstream: 0.2 - 1.4.15
External linkshttp://x-stream.github.io/changes.html#1.4.16
http://github.com/x-stream/xstream/security/advisories/GHSA-hrcp-8f3q-4w2c
http://lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fac48b425c6e16b0@%3Cdev.jmeter.apache.org%3E
http://lists.debian.org/debian-lts-announce/2021/04/msg00002.html
http://x-stream.github.io/CVE-2021-21351.html
http://x-stream.github.io/security.html#workaround
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
4) Resource exhaustion
EUVDB-ID: #VU52570
Risk: Medium
CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2021-21341
CWE-ID:
CWE-400 - Resource exhaustion
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.
MitigationInstall updates from vendor's website.
Vulnerable software versionsxstream: 0.2 - 1.4.15
External linkshttp://x-stream.github.io/changes.html#1.4.16
http://github.com/x-stream/xstream/security/advisories/GHSA-2p3x-qw9c-25hh
http://lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fac48b425c6e16b0@%3Cdev.jmeter.apache.org%3E
http://lists.debian.org/debian-lts-announce/2021/04/msg00002.html
http://x-stream.github.io/CVE-2021-21341.html
http://x-stream.github.io/security.html#workaround
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
5) Deserialization of Untrusted Data
EUVDB-ID: #VU52569
Risk: High
CVSSv3.1: 7.9 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2021-21342
CWE-ID:
CWE-502 - Deserialization of Untrusted Data
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform SSRF attacks.
The vulnerability exists due to insecure input validation when processing serialized data. A remote attacker can pass specially crafted data to the application and perform SSRF attack.
Install updates from vendor's website.
Vulnerable software versionsxstream: 0.2 - 1.4.15
External linkshttp://x-stream.github.io/changes.html#1.4.16
http://github.com/x-stream/xstream/security/advisories/GHSA-hvv8-336g-rx3m
http://lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fac48b425c6e16b0@%3Cdev.jmeter.apache.org%3E
http://lists.debian.org/debian-lts-announce/2021/04/msg00002.html
http://x-stream.github.io/CVE-2021-21342.html
http://x-stream.github.io/security.html#workaround
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
6) Deserialization of Untrusted Data
EUVDB-ID: #VU52568
Risk: Medium
CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2021-21343
CWE-ID:
CWE-502 - Deserialization of Untrusted Data
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to delete arbitrary files.
The vulnerability exists due to insecure input validation when processing serialized data where the processed stream at unmarshalling time contains type information to recreate the formerly written objects. A remote attacker can pass specially crafted data to the application and delete arbitrary files.
Install updates from vendor's website.
Vulnerable software versionsxstream: 0.2 - 1.4.15
External linkshttp://x-stream.github.io/changes.html#1.4.16
http://github.com/x-stream/xstream/security/advisories/GHSA-74cv-f58x-f9wf
http://lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fac48b425c6e16b0@%3Cdev.jmeter.apache.org%3E
http://lists.debian.org/debian-lts-announce/2021/04/msg00002.html
http://x-stream.github.io/CVE-2021-21343.html
http://x-stream.github.io/security.html#workaround
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
7) Resource exhaustion
EUVDB-ID: #VU52566
Risk: Medium
CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2021-21348
CWE-ID:
CWE-400 - Resource exhaustion
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.
MitigationInstall updates from vendor's website.
Vulnerable software versionsxstream: 0.2 - 1.4.15
External linkshttp://x-stream.github.io/changes.html#1.4.16
http://github.com/x-stream/xstream/security/advisories/GHSA-56p8-3fh9-4cvq
http://lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fac48b425c6e16b0@%3Cdev.jmeter.apache.org%3E
http://lists.debian.org/debian-lts-announce/2021/04/msg00002.html
http://x-stream.github.io/CVE-2021-21348.html
http://x-stream.github.io/security.html#workaround
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
8) Deserialization of Untrusted Data
EUVDB-ID: #VU52565
Risk: High
CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2021-21350
CWE-ID:
CWE-502 - Deserialization of Untrusted Data
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to insecure input validation when processing serialized data. A remote attacker can pass specially crafted data to the application and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsxstream: 0.2 - 1.4.15
External linkshttp://x-stream.github.io/changes.html#1.4.16
http://github.com/x-stream/xstream/security/advisories/GHSA-43gc-mjxg-gvrq
http://lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fac48b425c6e16b0@%3Cdev.jmeter.apache.org%3E
http://lists.debian.org/debian-lts-announce/2021/04/msg00002.html
http://x-stream.github.io/CVE-2021-21350.html
http://x-stream.github.io/security.html#workaround
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
9) Deserialization of Untrusted Data
EUVDB-ID: #VU52564
Risk: High
CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2021-21347
CWE-ID:
CWE-502 - Deserialization of Untrusted Data
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to insecure input validation when processing serialized data. A remote attacker can pass specially crafted data to the application and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsxstream: 0.2 - 1.4.15
External linkshttp://x-stream.github.io/changes.html#1.4.16
http://github.com/x-stream/xstream/security/advisories/GHSA-qpfq-ph7r-qv6f
http://lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fac48b425c6e16b0@%3Cdev.jmeter.apache.org%3E
http://lists.debian.org/debian-lts-announce/2021/04/msg00002.html
http://x-stream.github.io/CVE-2021-21347.html
http://x-stream.github.io/security.html#workaround
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
10) Deserialization of Untrusted Data
EUVDB-ID: #VU52563
Risk: High
CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2021-21346
CWE-ID:
CWE-502 - Deserialization of Untrusted Data
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to insecure input validation when processing serialized data. A remote attacker can pass specially crafted data to the application and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsxstream: 0.2 - 1.4.15
External linkshttp://x-stream.github.io/changes.html#1.4.16
http://github.com/x-stream/xstream/security/advisories/GHSA-4hrm-m67v-5cxr
http://lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fac48b425c6e16b0@%3Cdev.jmeter.apache.org%3E
http://lists.debian.org/debian-lts-announce/2021/04/msg00002.html
http://x-stream.github.io/CVE-2021-21346.html
http://x-stream.github.io/security.html#workaround
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
11) Deserialization of Untrusted Data
EUVDB-ID: #VU52562
Risk: High
CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2021-21345
CWE-ID:
CWE-502 - Deserialization of Untrusted Data
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to insecure input validation when processing serialized data. A remote attacker can pass specially crafted data to the application and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsxstream: 0.2 - 1.4.15
External linkshttp://x-stream.github.io/changes.html#1.4.16
http://github.com/x-stream/xstream/security/advisories/GHSA-hwpc-8xqv-jvj4
http://lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fac48b425c6e16b0@%3Cdev.jmeter.apache.org%3E
http://lists.debian.org/debian-lts-announce/2021/04/msg00002.html
http://x-stream.github.io/CVE-2021-21345.html
http://x-stream.github.io/security.html#workaround
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
