Deserialization of Untrusted Data in xstream - CVE-2021-21343

Vulnerability identifier: #VU52568

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-21343

CWE-ID: CWE-502

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to delete arbitrary files.

The vulnerability exists due to insecure input validation when processing serialized data where the processed stream at unmarshalling time contains type information to recreate the formerly written objects. A remote attacker can pass specially crafted data to the application and delete arbitrary files.

xstream
SUSE Linux Enterprise Module for SUSE Manager Server
Ubuntu
SUSE Linux Enterprise Module for Development Tools
openEuler
Fedora
IBM Tivoli Netcool Configuration Manager
Storage Copy Data Management
Red Hat Process Automation Manager (formerly JBoss BPM Suite)
Red Hat Decision Manager
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Security Verify Governance
libxstream-java (Ubuntu package)
xstream
xstream-javadoc
xstream-hibernate
xstream-benchmark
xstream-parent
Fuse

Install updates from vendor's website.

xstream - update to 1.4.16
IBM Tivoli Netcool Configuration Manager - update to 6.4.2.14
Red Hat Process Automation Manager (formerly JBoss BPM Suite) - update to 7.11.0
Red Hat Decision Manager - update to 7.11.0
libxstream-java (Ubuntu package) - addressed in versions Ubuntu Pro, 1.4.11.1-1ubuntu0.2, 1.4.11.1-1~18.04.2, 1.4.11.1-2ubuntu0.1, 1.4.15-1ubuntu0.1
xstream - update to 1.4.16-1
xstream-javadoc - update to 1.4.16-1
xstream-hibernate - update to 1.4.16-1
xstream-benchmark - update to 1.4.16-1
xstream-parent - update to 1.4.16-1
xstream - update to 1.4.16-3.8.1
xstream - addressed in versions 1.4.18-2.fc33, 1.4.18-2.fc34, 1.4.18-2.fc35
Storage Copy Data Management - update to 2.2.26.0
IBM Watson Discovery for IBM Cloud Pak for Data - addressed in versions 4.8.8, 5.1.0
Fuse - update to 7.10.0
IBM Security Verify Governance - update to 10.0.1.0.2

• http://x-stream.github.io/changes.html#1.4.16
• https://github.com/x-stream/xstream/security/advisories/GHSA-74cv-f58x-f9wf
• https://lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fac48b425c6e16b0@%3Cdev.jmeter.apache.org%3E
• https://lists.debian.org/debian-lts-announce/2021/04/msg00002.html
• https://x-stream.github.io/CVE-2021-21343.html
• https://x-stream.github.io/security.html#workaround

• Multiple vulnerabilities in XStream
• Multiple vulnerabilities in Red Hat Process Automation Manager
• Multiple vulnerabilities in Red Hat Decision Manager
• SUSE update for xstream
• SUSE update for xstream
• Ubuntu update for libxstream-java
• Multiple vulnerabilities in IBM Tivoli Netcool Configuration Manager
• Multiple vulnerabilities in IBM Security Verify Governance
• openEuler 20.03 LTS SP1 update for xstream
• Ubuntu update for libxstream-java
• Multiple vulnerabilities in Fuse 7.10
• Fedora 35 update for xstream
• Fedora 33 update for xstream
• Fedora 34 update for xstream
• Fedora 33 update for xstream
• Fedora 34 update for xstream
• Fedora 35 update for xstream
• Multiple vulnerabilities in IBM Watson Discovery
• Multiple vulnerabilities in IBM Storage Copy Data Management