Deserialization of Untrusted Data in xstream - CVE-2021-21345

Vulnerability identifier: #VU52562

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-21345

CWE-ID: CWE-502

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insecure input validation when processing serialized data. A remote attacker can pass specially crafted data to the application and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

xstream
xstream (Red Hat package)
libxstream-java (Ubuntu package)
xstream
xstream-parent
xstream-benchmark
xstream-hibernate
xstream-javadoc
Oracle Banking Platform
IBM Tivoli Netcool Configuration Manager
Oracle Retail Xstore Point of Service
Storage Copy Data Management
Oracle Banking Enterprise Default Management
Red Hat Decision Manager
Oracle Communications Unified Inventory Management
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Security Verify Governance
EMC Data Protection Advisor
SUSE Linux Enterprise Module for SUSE Manager Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Desktop
CentOS
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux for IBM z Systems
Ubuntu
SUSE Linux Enterprise Module for Development Tools
openEuler
Fedora
Red Hat Process Automation Manager (formerly JBoss BPM Suite)
RSA Authentication Manager
Oracle WebCenter Portal
Oracle Business Activity Monitoring
Oracle Communications BRM - Elastic Charging Engine
Fuse

Install updates from vendor's website.

xstream - update to 1.4.16
xstream (Red Hat package) - update to 1.3.1-13.el7_9
IBM Tivoli Netcool Configuration Manager - update to 6.4.2.14
Red Hat Decision Manager - update to 7.11.0
Red Hat Process Automation Manager (formerly JBoss BPM Suite) - update to 7.11.0
RSA Authentication Manager - addressed in versions 8.7 SP1 Patch 3 Hotfix 3, 8.7 SP2 Patch 6 Hotfix 1, 8.8 Patch 3 Hotifx 2, 8.9 Patch 1
libxstream-java (Ubuntu package) - addressed in versions Ubuntu Pro, 1.4.11.1-1ubuntu0.2, 1.4.11.1-1~18.04.2, 1.4.11.1-2ubuntu0.1, 1.4.15-1ubuntu0.1
xstream - update to 1.4.16-1
xstream-parent - update to 1.4.16-1
xstream-benchmark - update to 1.4.16-1
xstream-hibernate - update to 1.4.16-1
xstream-javadoc - update to 1.4.16-1
xstream - update to 1.4.16-3.8.1
xstream - addressed in versions 1.4.18-2.fc33, 1.4.18-2.fc34, 1.4.18-2.fc35
Storage Copy Data Management - update to 2.2.26.0
IBM Watson Discovery for IBM Cloud Pak for Data - addressed in versions 4.8.8, 5.1.0
Fuse - update to 7.10.0
IBM Security Verify Governance - update to 10.0.1.0.2
EMC Data Protection Advisor - update to 19.11

• http://x-stream.github.io/changes.html#1.4.16
• https://github.com/x-stream/xstream/security/advisories/GHSA-hwpc-8xqv-jvj4
• https://lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fac48b425c6e16b0@%3Cdev.jmeter.apache.org%3E
• https://lists.debian.org/debian-lts-announce/2021/04/msg00002.html
• https://x-stream.github.io/CVE-2021-21345.html
• https://x-stream.github.io/security.html#workaround

• Multiple vulnerabilities in XStream
• Red Hat Enterprise Linux 7 update for xstream
• CentOS 7 update for xstream
• Multiple vulnerabilities in Red Hat Process Automation Manager
• Multiple vulnerabilities in Red Hat Decision Manager
• Multiple vulnerabilities in Oracle Communications Unified Inventory Management
• Multiple vulnerabilities in Oracle Communications BRM - Elastic Charging Engine
• Deserialization of Untrusted Data in Oracle Banking Platform
• Deserialization of Untrusted Data in Oracle Banking Enterprise Default Management
• Multiple vulnerabilities in Oracle WebCenter Portal
• Deserialization of Untrusted Data in Oracle BAM (Business Activity Monitoring)
• Multiple vulnerabilities in Oracle Retail Xstore Point of Service
• SUSE update for xstream
• SUSE update for xstream
• Ubuntu update for libxstream-java
• Multiple vulnerabilities in IBM Tivoli Netcool Configuration Manager
• Multiple vulnerabilities in IBM Security Verify Governance
• openEuler 20.03 LTS SP1 update for xstream
• Multiple vulnerabilities in Dell Protection Advisor
• Ubuntu update for libxstream-java
• Multiple vulnerabilities in Fuse 7.10
• Fedora 35 update for xstream
• Fedora 33 update for xstream
• Fedora 34 update for xstream
• Fedora 33 update for xstream
• Fedora 34 update for xstream
• Fedora 35 update for xstream
• Multiple vulnerabilities in IBM Watson Discovery
• Multiple vulnerabilities in IBM Storage Copy Data Management
• RSA Authentication Manager update for third-party components
• RSA Authentication Manager update for third-party components