Resource exhaustion in xstream - CVE-2021-43859

Vulnerability identifier: #VU60527

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-43859

CWE-ID: CWE-400

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

xstream
Red Hat Integration Camel Extensions for Quarkus
Atlas eDiscovery Process Management
Oracle Communications Unified Inventory Management
Oracle Communications Diameter Intelligence Hub
IBM Spectrum Protect Plus
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Sterling B2B Integrator
IBM Security Verify Governance
Jenkins
Jenkins LTS
Oracle Financial Services Revenue Management and Billing
Oracle WebCenter Portal
jenkins (Red Hat package)
atomic-openshift (Red Hat package)
openshift-ansible (Red Hat package)
atomic-openshift-cluster-autoscaler (Red Hat package)
golang-github-prometheus-alertmanager (Red Hat package)
atomic-openshift-service-idler (Red Hat package)
atomic-openshift-metrics-server (Red Hat package)
atomic-openshift-node-problem-detector (Red Hat package)
openshift-enterprise-autoheal (Red Hat package)
atomic-openshift-web-console (Red Hat package)
atomic-openshift-descheduler (Red Hat package)
openshift-enterprise-cluster-capacity (Red Hat package)
golang-github-openshift-oauth-proxy (Red Hat package)
golang-github-prometheus-node_exporter (Red Hat package)
atomic-enterprise-service-catalog (Red Hat package)
golang-github-prometheus-prometheus (Red Hat package)
atomic-openshift-dockerregistry (Red Hat package)
openshift-kuryr (Red Hat package)
jenkins-2-plugins (Red Hat package)
xstream-hibernate
xstream-benchmark
xstream-javadoc
xstream-parent
xstream
Red Hat OpenShift Container Platform
RecoverPoint Classic
Oracle FLEXCUBE Private Banking
Oracle Communications Policy Management
Oracle Retail Customer Insights
Storage Copy Data Management
IBM Tivoli Netcool Configuration Manager
Engineering Test Management
IBM Qradar SIEM
Fedora
openEuler
Oracle Communications BRM - Elastic Charging Engine
Oracle WebCenter Sites
Oracle Business Activity Monitoring

Install updates from vendor's website.

xstream - update to 1.4.19
Jenkins - update to 2.334
Jenkins LTS - update to 2.319.3
jenkins (Red Hat package) - update to 2.319.3.1650348949-1.el7
Red Hat OpenShift Container Platform - update to 3.11.665
atomic-openshift (Red Hat package) - update to 3.11.685-1.git.0.7faaeaa.el7
openshift-ansible (Red Hat package) - update to 3.11.685-1.git.0.a9090ac.el7
atomic-openshift-cluster-autoscaler (Red Hat package) - update to 3.11.685-1.g99b2acf.el7
golang-github-prometheus-alertmanager (Red Hat package) - update to 3.11.685-1.g13de638.el7
atomic-openshift-service-idler (Red Hat package) - update to 3.11.685-1.g39cfc66.el7
atomic-openshift-metrics-server (Red Hat package) - update to 3.11.685-1.gf8bf728.el7
atomic-openshift-node-problem-detector (Red Hat package) - update to 3.11.685-1.gc8f26da.el7
openshift-enterprise-autoheal (Red Hat package) - update to 3.11.685-1.gf2f435d.el7
atomic-openshift-web-console (Red Hat package) - update to 3.11.685-1.gd742e61.el7
atomic-openshift-descheduler (Red Hat package) - update to 3.11.685-1.gd435537.el7
openshift-enterprise-cluster-capacity (Red Hat package) - update to 3.11.685-1.g22be164.el7
golang-github-openshift-oauth-proxy (Red Hat package) - update to 3.11.685-1.gedebe84.el7
golang-github-prometheus-node_exporter (Red Hat package) - update to 3.11.685-1.g609cd20.el7
atomic-enterprise-service-catalog (Red Hat package) - update to 3.11.685-1.g2e6be86.el7
golang-github-prometheus-prometheus (Red Hat package) - update to 3.11.685-1.g99aae51.el7
atomic-openshift-dockerregistry (Red Hat package) - update to 3.11.685-1.g3571208.el7
openshift-kuryr (Red Hat package) - update to 3.11.685-1.g0c4bf66.el7
jenkins-2-plugins (Red Hat package) - update to 3.11.1650371376-1.el7
RecoverPoint Classic - update to 5.1 SP4 P4
Atlas eDiscovery Process Management - update to 6.0.3.9.7
IBM Qradar SIEM - addressed in versions 7.3.3 Fix Pack 12, 7.4.3 Fix Pack 6, 7.5.0 Update Pack 2
IBM Spectrum Protect Plus - update to 10.1.11
Oracle Communications BRM - Elastic Charging Engine - update to 12.0.0.5.1
xstream-hibernate - update to 1.4.18-2
xstream-benchmark - update to 1.4.18-2
xstream-javadoc - update to 1.4.18-2
xstream-parent - update to 1.4.18-2
xstream - update to 1.4.18-2
xstream - addressed in versions 1.4.19-1.fc34, 1.4.19-1.fc35, 1.4.20-1.el8
Storage Copy Data Management - update to 2.2.26.0
IBM Watson Discovery for IBM Cloud Pak for Data - addressed in versions 4.8.8, 5.1.0
IBM Sterling B2B Integrator - addressed in versions 6.0.3.7, 6.1.0.5, 6.1.1.2, 6.1.2.0
IBM Tivoli Netcool Configuration Manager - update to 6.4.2.17
Engineering Test Management - addressed in versions 7.0.1.0.21, 7.0.2.0.22
IBM Security Verify Governance - update to 10.0.1.0.2

• https://github.com/x-stream/xstream/security/advisories/GHSA-rmr5-cpv2-vgjf
• https://x-stream.github.io/CVE-2021-43859.html
• https://github.com/x-stream/xstream/commit/e8e88621ba1c85ac3b8620337dd672e0c0c3a846
• http://www.openwall.com/lists/oss-security/2022/02/09/1

• Denial of service in XStream
• Multiple vulnerabilities in Jenkins and Jenkins LTS
• Multiple vulnerabilities in Oracle Communications Policy Management
• Multiple vulnerabilities in Oracle Communications Diameter Intelligence Hub
• Multiple vulnerabilities in OpenShift Container Platform 3.11
• Multiple vulnerabilities in IBM Spectrum Protect Plus
• Multiple vulnerabilities in Oracle Communications BRM - Elastic Charging Engine
• Multiple vulnerabilities in Oracle FLEXCUBE Private Banking
• Multiple vulnerabilities in Red Hat Integration Camel Extensions for Quarkus 2.7
• Multiple vulnerabilities in IBM QRadar SIEM
• Denial of service in IBM Sterling B2B Integrator
• Multiple vulnerabilities in Oracle Retail Customer Insights
• Resource exhaustion in Oracle Business Activity Monitoring
• Multiple vulnerabilities in Oracle WebCenter Sites
• Multiple vulnerabilities in Oracle WebCenter Portal
• Resource exhaustion in IBM Tivoli Netcool Configuration Manager
• Multiple vulnerabilities in Oracle Financial Services Revenue Management and Billing
• Resource exhaustion in IBM Engineering Test Management (ETM)
• Multiple vulnerabilities in IBM Atlas eDiscovery Process Management
• Multiple vulnerabilities in Dell RecoverPoint Classic
• Multiple vulnerabilities in IBM Security Verify Governance
• Multiple vulnerabilities in Oracle Communications Unified Inventory Management
• Fedora EPEL 8 update for xstream
• openEuler update for xstream
• openEuler 22.03 LTS update for xstream
• Fedora 35 update for xstream
• Fedora 34 update for xstream
• Multiple vulnerabilities in IBM Watson Discovery
• Multiple vulnerabilities in IBM Storage Copy Data Management