CVE-2021-39139
published 2021-08-23CVE-2021-39139: XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute…
PriorityP261high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
4.54%
90.5th percentile
XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. A user is only affected if using the version out of the box with JDK 1.7u21 or below. However, this scenario can be adjusted easily to an external Xalan that works regardless of the version of the Java runtime. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.
Affected
36 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | libxstream-java | < libxstream-java 1.4.18-1 (bookworm) | libxstream-java 1.4.18-1 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| oracle | business_activity_monitoring | — | — |
| oracle | commerce_guided_search | — | — |
| oracle | communications_billing_and_revenue_management_elastic_charging_engine | — | — |
| oracle | communications_billing_and_revenue_management_elastic_charging_engine | — | — |
| oracle | communications_cloud_native_core_automated_test_suite | — | — |
| oracle | communications_cloud_native_core_binding_support_function | — | — |
| oracle | communications_cloud_native_core_policy | — | — |
| oracle | communications_unified_inventory_management | — | — |
| oracle | communications_unified_inventory_management | — | — |
| oracle | communications_unified_inventory_management | — | — |
| oracle | communications_unified_inventory_management | — | — |
| oracle | communications_unified_inventory_management | — | — |
| oracle | retail_xstore_point_of_service | — | — |
| oracle | retail_xstore_point_of_service | — | — |
| oracle | retail_xstore_point_of_service | — | — |
| oracle | retail_xstore_point_of_service | — | — |
| oracle | retail_xstore_point_of_service | — | — |
| oracle | utilities_framework | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →The vulnerability is exploited via unsafe deserialization of Xalan xsltc.trax.TemplatesImpl through XStream — monitor for deserialization of this class in XML input streams processed by XStream ↗
- →Attack vector is manipulation of the processed XML input stream sent to XStream — inspect/filter XML payloads referencing Xalan or TemplatesImpl class references before deserialization ↗
- →The exploit can be triggered using an external Xalan library regardless of JDK version — do not assume JDK version alone provides protection; treat any XStream instance without a whitelist as exploitable ↗
- ·Only users running XStream out of the box with JDK 1.7u21 or below are affected by the default scenario; however, use of an external Xalan removes the JDK version constraint entirely ↗
- ·Users who have configured XStream's security framework with a type whitelist limited to the minimum required types are NOT affected — absence of a whitelist is the exploitable condition ↗
- ·XStream 1.4.18 removes the blacklist default; upgrading to this version mitigates the issue at the library level ↗
- ·OpenShift Container Platform Jenkins packages are NOT affected due to JEP-200 and JEP-228 Jenkins project hardening ↗
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
ghsa8.8HIGH
osv8.8HIGH
vendor_oracle8.8HIGH
vendor_debian8.5HIGH
vendor_redhat8.5HIGH
vendor_ubuntu8.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
XStream vulnerabilities
vendor_ubuntu·2023-03-13·CVSS 8.5
CVE-2021-39141 [HIGH] XStream vulnerabilities
Title: XStream vulnerabilities
Summary: Several security issues were fixed in XStream.
Lai Han discovered that XStream incorrectly handled certain inputs.
If a user or an automated system were tricked into opening a specially crafted
input file, a remote attacker could possibly use this issue to cause a denial
of service. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS.
(CVE-2021-39140)
It was discovered that XStream incorrectly handled certain inputs. If
a user or an automated system were tricked into opening a specially crafted
input file, a remote attacker could possibly use this issue to execute
arbitrary code. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04
LTS. (CVE-2021-39139, CVE-2021-39141, CVE-2021-39144, CVE-2021-39145,
CVE-2021-39146, CVE-2021-39147
Oracle
Oracle Oracle Fusion Middleware Risk Matrix: Security Framework (XStream) — CVE-2021-39139
vendor_oracle·2022-07-15·CVSS 8.8
CVE-2021-39139 [HIGH] Oracle Oracle Fusion Middleware Risk Matrix: Security Framework (XStream) — CVE-2021-39139
Oracle Oracle Fusion Middleware Risk Matrix: Security Framework (XStream) vulnerability
CVE: CVE-2021-39139
CVSS: 8.8
Protocol: HTTP
Remote exploit: No
Affected versions: Network
Advisory: cpujul2022 (JUL 2022)
Oracle
Oracle Oracle Commerce Risk Matrix: Content Acquisition System (XStream) — CVE-2021-39139
vendor_oracle·2022-04-15·CVSS 8.8
CVE-2021-39139 [HIGH] Oracle Oracle Commerce Risk Matrix: Content Acquisition System (XStream) — CVE-2021-39139
Oracle Oracle Commerce Risk Matrix: Content Acquisition System (XStream) vulnerability
CVE: CVE-2021-39139
CVSS: 8.8
Protocol: HTTP
Remote exploit: No
Affected versions: Network
Advisory: cpuapr2022 (APR 2022)
Oracle
Oracle Oracle Communications Applications Risk Matrix: Updater (XStream) — CVE-2021-39139
vendor_oracle·2022-01-15·CVSS 8.8
CVE-2021-39139 [HIGH] Oracle Oracle Communications Applications Risk Matrix: Updater (XStream) — CVE-2021-39139
Oracle Oracle Communications Applications Risk Matrix: Updater (XStream) vulnerability
CVE: CVE-2021-39139
CVSS: 8.8
Protocol: TCP
Remote exploit: No
Affected versions: Network
Advisory: cpujan2022 (JAN 2022)
Red Hat
xstream: Arbitrary code execution via unsafe deserialization of Xalan xsltc.trax.TemplatesImpl
vendor_redhat·2021-08-22·CVSS 8.5
CVE-2021-39139 [HIGH] CWE-502 xstream: Arbitrary code execution via unsafe deserialization of Xalan xsltc.trax.TemplatesImpl
xstream: Arbitrary code execution via unsafe deserialization of Xalan xsltc.trax.TemplatesImpl
XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. A user is only affected if using the version out of the box with JDK 1.7u21 or below. However, this scenario can be adjusted easily to an external Xalan that works regardless of the version of the Java runtime. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.
Debian
CVE-2021-39139: libxstream-java - XStream is a simple library to serialize objects to XML and back again. In affec...
vendor_debian·2021·CVSS 8.5
CVE-2021-39139 [HIGH] CVE-2021-39139: libxstream-java - XStream is a simple library to serialize objects to XML and back again. In affec...
XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. A user is only affected if using the version out of the box with JDK 1.7u21 or below. However, this scenario can be adjusted easily to an external Xalan that works regardless of the version of the Java runtime. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.
Scope: local
bookworm: resolved (fixed in 1.4.18-1)
bullseye: resolved (fixed in 1.4.15-3+deb11u1
OSV
libxstream-java vulnerabilities
osv·2023-03-13·CVSS 8.8
CVE-2021-39140 [HIGH] libxstream-java vulnerabilities
libxstream-java vulnerabilities
Lai Han discovered that XStream incorrectly handled certain inputs.
If a user or an automated system were tricked into opening a specially crafted
input file, a remote attacker could possibly use this issue to cause a denial
of service. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS.
(CVE-2021-39140)
It was discovered that XStream incorrectly handled certain inputs. If
a user or an automated system were tricked into opening a specially crafted
input file, a remote attacker could possibly use this issue to execute
arbitrary code. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04
LTS. (CVE-2021-39139, CVE-2021-39141, CVE-2021-39144, CVE-2021-39145,
CVE-2021-39146, CVE-2021-39147, CVE-2021-39148, CVE-2021-39149,
CVE-2021-39151, CVE-20
OSV
XStream is vulnerable to an Arbitrary Code Execution attack
osv·2021-08-25·CVSS 8.8
CVE-2021-39139 [HIGH] XStream is vulnerable to an Arbitrary Code Execution attack
XStream is vulnerable to an Arbitrary Code Execution attack
### Impact
The vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. A user is only affected if using the version out of the box with JDK 1.7u21 or below. However, this scenario can be adjusted easily to an external Xalan that works regardless of the version of the Java runtime. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types.
### Patches
XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.
### Workarounds
See [workarounds](https://x-stream.github.io/security.html#workaround) for the different
GHSA
XStream is vulnerable to an Arbitrary Code Execution attack
ghsa·2021-08-25·CVSS 8.8
CVE-2021-39139 [HIGH] CWE-502 XStream is vulnerable to an Arbitrary Code Execution attack
XStream is vulnerable to an Arbitrary Code Execution attack
### Impact
The vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. A user is only affected if using the version out of the box with JDK 1.7u21 or below. However, this scenario can be adjusted easily to an external Xalan that works regardless of the version of the Java runtime. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types.
### Patches
XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.
### Workarounds
See [workarounds](https://x-stream.github.io/security.html#workaround) for the different
OSV
CVE-2021-39139: XStream is a simple library to serialize objects to XML and back again
osv·2021-08-23·CVSS 8.8
CVE-2021-39139 [HIGH] CVE-2021-39139: XStream is a simple library to serialize objects to XML and back again
XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. A user is only affected if using the version out of the box with JDK 1.7u21 or below. However, this scenario can be adjusted easily to an external Xalan that works regardless of the version of the Java runtime. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.
No detection rules found.
No public exploits indexed.
arXiv
Forecasting the risk of software choices: A model to foretell security vulnerabilities from library dependencies and source code evolution
arxiv_fulltext·2024-11-17
Forecasting the risk of software choices: A model to foretell security vulnerabilities from library dependencies and source code evolution
Carlos E.\ Budde
0000-0001-8807-1548
[email protected]
Ranindya Paramitha
0000-0002-6682-4243
[email protected]
University of Trento
Trento
Italy
Fabio Massacci
0000-0002-1091-8486
University of Trento
Trento
Italy
Vre Universiteit
Amsterdam
The Netherlands
Budde, Paramitha, Massacci
## Abstract
Software security mainly studies vulnerability detection: is my code vulnerable today?
This hinders risk estimation, so new approaches are emerging to forecast the occurrence of future vulnerabilities.
While useful, these approaches are coarse-grained and hard to employ for project-specific technical decisions.
We introduce a model capable of vulnerability forecasting at library level.
Formalising source-code evolution in time together with library dependency, our model
arXiv
ML-FEED: Machine Learning Framework for Efficient Exploit Detection
arxiv_fulltext·2023-03-06
ML-FEED: Machine Learning Framework for Efficient Exploit Detection
## Abstract
Machine learning (ML)-based methods have recently become attractive for detecting security vulnerability
exploits. Unfortunately, state-of-the-art ML models like long short-term memories (LSTMs) and
transformers incur significant computation overheads. This overhead makes it infeasible to deploy them in
real-time environments. We propose a novel ML-based exploit detection model, ML-FEED, that enables
highly efficient inference without sacrificing performance.
We develop a novel automated technique to extract
vulnerability patterns from the Common Weakness Enumeration (CWE) and Common Vulnerabilities and Exposures (CVE)
databases. This feature enables ML-FEED to be aware of the latest cyber weaknesses.
Second, it is not based on the traditional approach of classifying sequences
Bugzilla
CVE-2021-39139 xstream: Arbitrary code execution via unsafe deserialization of Xalan xsltc.trax.TemplatesImpl
bugzilla·2021-08-25·CVSS 8.8
CVE-2021-39139 [HIGH] CVE-2021-39139 xstream: Arbitrary code execution via unsafe deserialization of Xalan xsltc.trax.TemplatesImpl
CVE-2021-39139 xstream: Arbitrary code execution via unsafe deserialization of Xalan xsltc.trax.TemplatesImpl
XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. A user is only affected if using the version out of the box with JDK 1.7u21 or below. However, this scenario can be adjusted easily to an external Xalan that works regardless of the version of the Java runtime. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for gen
https://github.com/x-stream/xstream/security/advisories/GHSA-64xx-cq4q-mf44https://lists.debian.org/debian-lts-announce/2021/09/msg00017.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/https://security.netapp.com/advisory/ntap-20210923-0003/https://www.debian.org/security/2021/dsa-5004https://www.oracle.com/security-alerts/cpuapr2022.htmlhttps://www.oracle.com/security-alerts/cpujan2022.htmlhttps://www.oracle.com/security-alerts/cpujul2022.htmlhttps://x-stream.github.io/CVE-2021-39139.htmlhttps://github.com/x-stream/xstream/security/advisories/GHSA-64xx-cq4q-mf44https://lists.debian.org/debian-lts-announce/2021/09/msg00017.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/https://security.netapp.com/advisory/ntap-20210923-0003/https://www.debian.org/security/2021/dsa-5004https://www.oracle.com/security-alerts/cpuapr2022.htmlhttps://www.oracle.com/security-alerts/cpujan2022.htmlhttps://www.oracle.com/security-alerts/cpujul2022.htmlhttps://x-stream.github.io/CVE-2021-39139.html
2021-08-23
Published