Resource exhaustion in xstream - CVE-2021-21348

Vulnerability identifier: #VU52566

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-21348

CWE-ID: CWE-400

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

xstream
SUSE Linux Enterprise Module for SUSE Manager Server
Ubuntu
SUSE Linux Enterprise Module for Development Tools
openEuler
Fedora
IBM Tivoli Netcool Configuration Manager
Storage Copy Data Management
Red Hat Process Automation Manager (formerly JBoss BPM Suite)
Red Hat Decision Manager
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Security Verify Governance
libxstream-java (Ubuntu package)
xstream
xstream-javadoc
xstream-hibernate
xstream-benchmark
xstream-parent
Fuse

Install updates from vendor's website.

xstream - update to 1.4.16
IBM Tivoli Netcool Configuration Manager - update to 6.4.2.14
Red Hat Process Automation Manager (formerly JBoss BPM Suite) - update to 7.11.0
Red Hat Decision Manager - update to 7.11.0
libxstream-java (Ubuntu package) - addressed in versions Ubuntu Pro, 1.4.11.1-1ubuntu0.2, 1.4.11.1-1~18.04.2, 1.4.11.1-2ubuntu0.1, 1.4.15-1ubuntu0.1
xstream - update to 1.4.16-1
xstream-javadoc - update to 1.4.16-1
xstream-hibernate - update to 1.4.16-1
xstream-benchmark - update to 1.4.16-1
xstream-parent - update to 1.4.16-1
xstream - update to 1.4.16-3.8.1
xstream - addressed in versions 1.4.18-2.fc33, 1.4.18-2.fc34, 1.4.18-2.fc35
Storage Copy Data Management - update to 2.2.26.0
IBM Watson Discovery for IBM Cloud Pak for Data - addressed in versions 4.8.8, 5.1.0
Fuse - update to 7.10.0
IBM Security Verify Governance - update to 10.0.1.0.2

• http://x-stream.github.io/changes.html#1.4.16
• https://github.com/x-stream/xstream/security/advisories/GHSA-56p8-3fh9-4cvq
• https://lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fac48b425c6e16b0@%3Cdev.jmeter.apache.org%3E
• https://lists.debian.org/debian-lts-announce/2021/04/msg00002.html
• https://x-stream.github.io/CVE-2021-21348.html
• https://x-stream.github.io/security.html#workaround

• Multiple vulnerabilities in XStream
• Multiple vulnerabilities in Red Hat Process Automation Manager
• Multiple vulnerabilities in Red Hat Decision Manager
• SUSE update for xstream
• SUSE update for xstream
• Ubuntu update for libxstream-java
• Multiple vulnerabilities in IBM Tivoli Netcool Configuration Manager
• Multiple vulnerabilities in IBM Security Verify Governance
• openEuler 20.03 LTS SP1 update for xstream
• Ubuntu update for libxstream-java
• Multiple vulnerabilities in Fuse 7.10
• Fedora 35 update for xstream
• Fedora 33 update for xstream
• Fedora 34 update for xstream
• Fedora 33 update for xstream
• Fedora 34 update for xstream
• Fedora 35 update for xstream
• Multiple vulnerabilities in IBM Watson Discovery
• Multiple vulnerabilities in IBM Storage Copy Data Management