Deserialization of Untrusted Data in xstream - CVE-2021-21351

Vulnerability identifier: #VU52571

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-21351

CWE-ID: CWE-502

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insecure input validation when processing serialized data. A remote attacker can pass specially crafted data to the application and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

xstream
SUSE Linux Enterprise Module for SUSE Manager Server
Ubuntu
SUSE Linux Enterprise Module for Development Tools
openEuler
Fedora
IBM Tivoli Netcool Configuration Manager
Storage Copy Data Management
Red Hat Process Automation Manager (formerly JBoss BPM Suite)
RSA Authentication Manager
Red Hat Decision Manager
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Security Verify Governance
EMC Data Protection Advisor
libxstream-java (Ubuntu package)
xstream
xstream-javadoc
xstream-hibernate
xstream-benchmark
xstream-parent
Fuse

Install updates from vendor's website.

xstream - update to 1.4.16
IBM Tivoli Netcool Configuration Manager - update to 6.4.2.14
Red Hat Process Automation Manager (formerly JBoss BPM Suite) - update to 7.11.0
Red Hat Decision Manager - update to 7.11.0
RSA Authentication Manager - addressed in versions 8.7 SP1 Patch 3 Hotfix 3, 8.7 SP2 Patch 6 Hotfix 1, 8.8 Patch 3 Hotifx 2, 8.9 Patch 1
libxstream-java (Ubuntu package) - addressed in versions Ubuntu Pro, 1.4.11.1-1ubuntu0.2, 1.4.11.1-1~18.04.2, 1.4.11.1-2ubuntu0.1, 1.4.15-1ubuntu0.1
xstream - update to 1.4.16-1
xstream-javadoc - update to 1.4.16-1
xstream-hibernate - update to 1.4.16-1
xstream-benchmark - update to 1.4.16-1
xstream-parent - update to 1.4.16-1
xstream - update to 1.4.16-3.8.1
xstream - addressed in versions 1.4.18-2.fc33, 1.4.18-2.fc34, 1.4.18-2.fc35
Storage Copy Data Management - update to 2.2.26.0
IBM Watson Discovery for IBM Cloud Pak for Data - addressed in versions 4.8.8, 5.1.0
Fuse - update to 7.10.0
IBM Security Verify Governance - update to 10.0.1.0.2
EMC Data Protection Advisor - update to 19.11

• http://x-stream.github.io/changes.html#1.4.16
• https://github.com/x-stream/xstream/security/advisories/GHSA-hrcp-8f3q-4w2c
• https://lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fac48b425c6e16b0@%3Cdev.jmeter.apache.org%3E
• https://lists.debian.org/debian-lts-announce/2021/04/msg00002.html
• https://x-stream.github.io/CVE-2021-21351.html
• https://x-stream.github.io/security.html#workaround

• Multiple vulnerabilities in XStream
• Multiple vulnerabilities in Red Hat Process Automation Manager
• Multiple vulnerabilities in Red Hat Decision Manager
• SUSE update for xstream
• SUSE update for xstream
• Ubuntu update for libxstream-java
• Multiple vulnerabilities in IBM Tivoli Netcool Configuration Manager
• Multiple vulnerabilities in IBM Security Verify Governance
• openEuler 20.03 LTS SP1 update for xstream
• Multiple vulnerabilities in Dell Protection Advisor
• Ubuntu update for libxstream-java
• Multiple vulnerabilities in Fuse 7.10
• Fedora 35 update for xstream
• Fedora 33 update for xstream
• Fedora 34 update for xstream
• Fedora 33 update for xstream
• Fedora 34 update for xstream
• Fedora 35 update for xstream
• Multiple vulnerabilities in IBM Watson Discovery
• Multiple vulnerabilities in IBM Storage Copy Data Management
• RSA Authentication Manager update for third-party components
• RSA Authentication Manager update for third-party components