Deserialization of Untrusted Data in xstream - CVE-2021-21350

Vulnerability identifier: #VU52565

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-21350

CWE-ID: CWE-502

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insecure input validation when processing serialized data. A remote attacker can pass specially crafted data to the application and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

xstream
xstream (Red Hat package)
libxstream-java (Ubuntu package)
xstream
xstream-parent
xstream-benchmark
xstream-hibernate
xstream-javadoc
SUSE Linux Enterprise Module for SUSE Manager Server
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power, little endian
CentOS
Ubuntu
SUSE Linux Enterprise Module for Development Tools
openEuler
Fedora
IBM Tivoli Netcool Configuration Manager
Storage Copy Data Management
Red Hat Decision Manager
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Security Verify Governance
EMC Data Protection Advisor
Red Hat Process Automation Manager (formerly JBoss BPM Suite)
RSA Authentication Manager
Fuse

Install updates from vendor's website.

xstream - update to 1.4.16
xstream (Red Hat package) - update to 1.3.1-13.el7_9
IBM Tivoli Netcool Configuration Manager - update to 6.4.2.14
Red Hat Decision Manager - update to 7.11.0
Red Hat Process Automation Manager (formerly JBoss BPM Suite) - update to 7.11.0
RSA Authentication Manager - addressed in versions 8.7 SP1 Patch 3 Hotfix 3, 8.7 SP2 Patch 6 Hotfix 1, 8.8 Patch 3 Hotifx 2, 8.9 Patch 1
libxstream-java (Ubuntu package) - addressed in versions Ubuntu Pro, 1.4.11.1-1ubuntu0.2, 1.4.11.1-1~18.04.2, 1.4.11.1-2ubuntu0.1, 1.4.15-1ubuntu0.1
xstream - update to 1.4.16-1
xstream-parent - update to 1.4.16-1
xstream-benchmark - update to 1.4.16-1
xstream-hibernate - update to 1.4.16-1
xstream-javadoc - update to 1.4.16-1
xstream - update to 1.4.16-3.8.1
xstream - addressed in versions 1.4.18-2.fc33, 1.4.18-2.fc34, 1.4.18-2.fc35
Storage Copy Data Management - update to 2.2.26.0
IBM Watson Discovery for IBM Cloud Pak for Data - addressed in versions 4.8.8, 5.1.0
Fuse - update to 7.10.0
IBM Security Verify Governance - update to 10.0.1.0.2
EMC Data Protection Advisor - update to 19.11

• http://x-stream.github.io/changes.html#1.4.16
• https://github.com/x-stream/xstream/security/advisories/GHSA-43gc-mjxg-gvrq
• https://lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fac48b425c6e16b0@%3Cdev.jmeter.apache.org%3E
• https://lists.debian.org/debian-lts-announce/2021/04/msg00002.html
• https://x-stream.github.io/CVE-2021-21350.html
• https://x-stream.github.io/security.html#workaround

• Multiple vulnerabilities in XStream
• Red Hat Enterprise Linux 7 update for xstream
• CentOS 7 update for xstream
• Multiple vulnerabilities in Red Hat Process Automation Manager
• Multiple vulnerabilities in Red Hat Decision Manager
• SUSE update for xstream
• SUSE update for xstream
• Ubuntu update for libxstream-java
• Multiple vulnerabilities in IBM Tivoli Netcool Configuration Manager
• Multiple vulnerabilities in IBM Security Verify Governance
• openEuler 20.03 LTS SP1 update for xstream
• Multiple vulnerabilities in Dell Protection Advisor
• Ubuntu update for libxstream-java
• Multiple vulnerabilities in Fuse 7.10
• Fedora 35 update for xstream
• Fedora 33 update for xstream
• Fedora 34 update for xstream
• Fedora 33 update for xstream
• Fedora 34 update for xstream
• Fedora 35 update for xstream
• Multiple vulnerabilities in IBM Watson Discovery
• Multiple vulnerabilities in IBM Storage Copy Data Management
• RSA Authentication Manager update for third-party components
• RSA Authentication Manager update for third-party components