CVE-2021-43859
published 2022-02-01CVE-2021-43859: XStream is an open source java library to serialize objects to XML and back again. Versions prior to 1.4.19 may allow a remote attacker to allocate 100% CPU…
PriorityP346high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
7.66%
93.9th percentile
XStream is an open source java library to serialize objects to XML and back again. Versions prior to 1.4.19 may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a payload resulting in a denial of service only by manipulating the processed input stream. XStream 1.4.19 monitors and accumulates the time it takes to add elements to collections and throws an exception if a set threshold is exceeded. Users are advised to upgrade as soon as possible. Users unable to upgrade may set the NO_REFERENCE mode to prevent recursion. See GHSA-rmr5-cpv2-vgjf for further details on a workaround if an upgrade is not possible.
Affected
25 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | libxstream-java | < libxstream-java 1.4.19-1 (bookworm) | libxstream-java 1.4.19-1 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| jenkins | jenkins | < 2.319.3 | 2.319.3 |
| jenkins | jenkins | < 2.334 | 2.334 |
| jenkins | jenkins | >= 2.321 < 2.334 | 2.334 |
| jenkins | jenkins_core | — | — |
| jenkins | jenkins_lts | — | — |
| jenkins | jenkins_weekly | — | — |
| jenkins_project | jenkins | unspecified – 2.333 | — |
| oracle | commerce_guided_search | — | — |
| oracle | communications_brm_elastic_charging_engine | < 12.0.0.4.6 | 12.0.0.4.6 |
| oracle | communications_brm_elastic_charging_engine | — | — |
| oracle | communications_cloud_native_core_automated_test_suite | — | — |
| oracle | communications_diameter_intelligence_hub | 8.0.0 – 8.1.0 | — |
| oracle | communications_diameter_intelligence_hub | 8.2.0 – 8.2.6 | — |
| oracle | communications_policy_management | — | — |
| oracle | flexcube_private_banking | — | — |
| oracle | retail_xstore_point_of_service | — | — |
| oracle | retail_xstore_point_of_service | — | — |
| oracle | retail_xstore_point_of_service | — | — |
| oracle | retail_xstore_point_of_service | — | — |
| oracle | retail_xstore_point_of_service | — | — |
| xstream | xstream | < 1.4.19 | 1.4.19 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
ghsa7.5HIGH
osv7.5HIGH
vendor_debian7.5HIGH
vendor_oracle7.5HIGH
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
DoS vulnerability in bundled XStream library in Jenkins Core
osv·2022-02-10·CVSS 7.5
CVE-2022-0538 [HIGH] DoS vulnerability in bundled XStream library in Jenkins Core
DoS vulnerability in bundled XStream library in Jenkins Core
Jenkins 2.333 and earlier, LTS 2.319.2 and earlier is affected by the XStream library’s vulnerability [CVE-2021-43859](https://x-stream.github.io/CVE-2021-43859.html). This library is used by Jenkins to serialize and deserialize various XML files, like global and job `config.xml`, `build.xml`, and numerous others.
This allows attackers able to submit crafted XML files to Jenkins to be parsed as configuration, e.g. through the `POST config.xml` API, to cause a denial of service (DoS).
GHSA
DoS vulnerability in bundled XStream library in Jenkins Core
ghsa·2022-02-10·CVSS 7.5
CVE-2022-0538 [HIGH] CWE-502 DoS vulnerability in bundled XStream library in Jenkins Core
DoS vulnerability in bundled XStream library in Jenkins Core
Jenkins 2.333 and earlier, LTS 2.319.2 and earlier is affected by the XStream library’s vulnerability [CVE-2021-43859](https://x-stream.github.io/CVE-2021-43859.html). This library is used by Jenkins to serialize and deserialize various XML files, like global and job `config.xml`, `build.xml`, and numerous others.
This allows attackers able to submit crafted XML files to Jenkins to be parsed as configuration, e.g. through the `POST config.xml` API, to cause a denial of service (DoS).
OSV
Denial of Service by injecting highly recursive collections or maps in XStream
osv·2022-02-01
CVE-2021-43859 [HIGH] Denial of Service by injecting highly recursive collections or maps in XStream
Denial of Service by injecting highly recursive collections or maps in XStream
### Impact
The vulnerability may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a payload resulting in a denial of service only by manipulating the processed input stream.
### Patches
XStream 1.4.19 monitors and accumulates the time it takes to add elements to collections and throws an exception if a set threshold is exceeded.
### Workarounds
The attack uses the hash code implementation for collections and maps to force an exponential calculation time due to highly recursive structures with in the collection or map. Following types of the Java runtime are affected in Java versions available in December 2021:
- java.util.HashMap
- jav
GHSA
Denial of Service by injecting highly recursive collections or maps in XStream
ghsa·2022-02-01
CVE-2021-43859 [HIGH] CWE-400 Denial of Service by injecting highly recursive collections or maps in XStream
Denial of Service by injecting highly recursive collections or maps in XStream
### Impact
The vulnerability may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a payload resulting in a denial of service only by manipulating the processed input stream.
### Patches
XStream 1.4.19 monitors and accumulates the time it takes to add elements to collections and throws an exception if a set threshold is exceeded.
### Workarounds
The attack uses the hash code implementation for collections and maps to force an exponential calculation time due to highly recursive structures with in the collection or map. Following types of the Java runtime are affected in Java versions available in December 2021:
- java.util.HashMap
- jav
OSV
CVE-2021-43859: XStream is an open source java library to serialize objects to XML and back again
osv·2022-02-01·CVSS 7.5
CVE-2021-43859 [HIGH] CVE-2021-43859: XStream is an open source java library to serialize objects to XML and back again
XStream is an open source java library to serialize objects to XML and back again. Versions prior to 1.4.19 may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a payload resulting in a denial of service only by manipulating the processed input stream. XStream 1.4.19 monitors and accumulates the time it takes to add elements to collections and throws an exception if a set threshold is exceeded. Users are advised to upgrade as soon as possible. Users unable to upgrade may set the NO_REFERENCE mode to prevent recursion. See GHSA-rmr5-cpv2-vgjf for further details on a workaround if an upgrade is not possible.
Oracle
Oracle Oracle Communications Applications Risk Matrix: Security (XStream) — CVE-2021-43859
vendor_oracle·2023-07-15·CVSS 7.5
CVE-2021-43859 [HIGH] Oracle Oracle Communications Applications Risk Matrix: Security (XStream) — CVE-2021-43859
Oracle Oracle Communications Applications Risk Matrix: Security (XStream) vulnerability
CVE: CVE-2021-43859
CVSS: 7.5
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpujul2023 (JUL 2023)
Oracle
Oracle Oracle Financial Services Applications Risk Matrix: Infrastructure (XStream) — CVE-2021-43859
vendor_oracle·2023-04-15·CVSS 7.5
CVE-2021-43859 [HIGH] Oracle Oracle Financial Services Applications Risk Matrix: Infrastructure (XStream) — CVE-2021-43859
Oracle Oracle Financial Services Applications Risk Matrix: Infrastructure (XStream) vulnerability
CVE: CVE-2021-43859
CVSS: 7.5
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpuapr2023 (APR 2023)
Oracle
Oracle Oracle Fusion Middleware Risk Matrix: General (XStream) — CVE-2021-43859
vendor_oracle·2022-10-15·CVSS 7.5
CVE-2021-43859 [HIGH] Oracle Oracle Fusion Middleware Risk Matrix: General (XStream) — CVE-2021-43859
Oracle Oracle Fusion Middleware Risk Matrix: General (XStream) vulnerability
CVE: CVE-2021-43859
CVSS: 7.5
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpuoct2022 (OCT 2022)
Oracle
Oracle Oracle Communications Applications Risk Matrix: EM Gateway (XStream) — CVE-2021-43859
vendor_oracle·2022-07-15·CVSS 7.5
CVE-2021-43859 [HIGH] Oracle Oracle Communications Applications Risk Matrix: EM Gateway (XStream) — CVE-2021-43859
Oracle Oracle Communications Applications Risk Matrix: EM Gateway (XStream) vulnerability
CVE: CVE-2021-43859
CVSS: 7.5
Protocol: TCP
Remote exploit: Yes
Affected versions: Network
Advisory: cpujul2022 (JUL 2022)
Oracle
Oracle Oracle Communications Risk Matrix: Visualization, Database (XStream) — CVE-2021-43859
vendor_oracle·2022-04-15·CVSS 7.5
CVE-2021-43859 [HIGH] Oracle Oracle Communications Risk Matrix: Visualization, Database (XStream) — CVE-2021-43859
Oracle Oracle Communications Risk Matrix: Visualization, Database (XStream) vulnerability
CVE: CVE-2021-43859
CVSS: 7.5
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpuapr2022 (APR 2022)
Red Hat
jenkins: DoS vulnerability in bundled XStream library
vendor_redhat·2022-02-09·CVSS 7.5
CVE-2022-0538 [HIGH] CWE-502 jenkins: DoS vulnerability in bundled XStream library
jenkins: DoS vulnerability in bundled XStream library
Jenkins 2.333 and earlier, LTS 2.319.2 and earlier defines custom XStream converters that have not been updated to apply the protections for the vulnerability CVE-2021-43859 and allow unconstrained resource usage.
A denial of service (DoS) flaw was found in Jenkins. This flaw allows an attacker to define custom XStream converters that do not protect against the vulnerability in CVE-2021-43859, allowing for uncontrolled resource consumption.
Package: jenkins (Red Hat Fuse 7) - Not affected
Package: jenkins (Red Hat OpenShift Container Platform 3.11) - Not affected
Package: jenkins (Red Hat OpenShift Container Platform 4) - Not affected
Jenkins
Jenkins Security Advisory 2022-02-09
vendor_jenkins·2022-02-09·CVSS 7.5
CVE-2021-43859 [HIGH] Jenkins Security Advisory 2022-02-09
Title: Jenkins Security Advisory 2022-02-09
Jenkins Security Advisory 2022-02-09
Jenkins Security Home
For Administrators
Overview
Terminology
Vulnerabilities and Scoring
Security Advisories
Security Issues
Advisory Schedule
Vulnerabilities in Plugins
How We Fix Security Issues
For Reporters
Reporting Vulnerabilities
Jenkins CNA
For Maintainers
Overview
Vulnerabilities in Plugins
Jenkins Security Team
About
Contributions
This advisory announces vulnerabilities in the following Jenkins deliverables:
Jenkins (core)
Descriptions
DoS vulnerability in bundled XStream library
SECURITY-2602
/
CVE-2021-43859 (upstream issue), CVE-2022-0538 (Jenkins-specific converters)
Severity (CVSS):
Red Hat
xstream: Injecting highly recursive collections or maps can cause a DoS
vendor_redhat·2022-01-29·CVSS 7.5
CVE-2021-43859 [HIGH] CWE-770 xstream: Injecting highly recursive collections or maps can cause a DoS
xstream: Injecting highly recursive collections or maps can cause a DoS
XStream is an open source java library to serialize objects to XML and back again. Versions prior to 1.4.19 may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a payload resulting in a denial of service only by manipulating the processed input stream. XStream 1.4.19 monitors and accumulates the time it takes to add elements to collections and throws an exception if a set threshold is exceeded. Users are advised to upgrade as soon as possible. Users unable to upgrade may set the NO_REFERENCE mode to prevent recursion. See GHSA-rmr5-cpv2-vgjf for further details on a workaround if an upgrade is not possible.
Statement: Red Hat Product Security h
Debian
CVE-2021-43859: libxstream-java - XStream is an open source java library to serialize objects to XML and back agai...
vendor_debian·2021·CVSS 7.5
CVE-2021-43859 [HIGH] CVE-2021-43859: libxstream-java - XStream is an open source java library to serialize objects to XML and back agai...
XStream is an open source java library to serialize objects to XML and back again. Versions prior to 1.4.19 may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a payload resulting in a denial of service only by manipulating the processed input stream. XStream 1.4.19 monitors and accumulates the time it takes to add elements to collections and throws an exception if a set threshold is exceeded. Users are advised to upgrade as soon as possible. Users unable to upgrade may set the NO_REFERENCE mode to prevent recursion. See GHSA-rmr5-cpv2-vgjf for further details on a workaround if an upgrade is not possible.
Scope: local
bookworm: resolved (fixed in 1.4.19-1)
bullseye: resolved (fixed in 1.4.15-3+deb11u3)
forky: resol
No detection rules found.
No public exploits indexed.
http://www.openwall.com/lists/oss-security/2022/02/09/1https://github.com/x-stream/xstream/commit/e8e88621ba1c85ac3b8620337dd672e0c0c3a846https://github.com/x-stream/xstream/security/advisories/GHSA-rmr5-cpv2-vgjfhttps://lists.debian.org/debian-lts-announce/2022/02/msg00018.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VACQYG356OHUTD5WQGAQ4L2TTFTAV3SJ/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XODFRE2ZL64FICBJDOPWOLPTSSAI4U7X/https://www.oracle.com/security-alerts/cpuapr2022.htmlhttps://www.oracle.com/security-alerts/cpujul2022.htmlhttps://x-stream.github.io/CVE-2021-43859.htmlhttp://www.openwall.com/lists/oss-security/2022/02/09/1https://github.com/x-stream/xstream/commit/e8e88621ba1c85ac3b8620337dd672e0c0c3a846https://github.com/x-stream/xstream/security/advisories/GHSA-rmr5-cpv2-vgjfhttps://lists.debian.org/debian-lts-announce/2022/02/msg00018.htmlhttps://lists.debian.org/debian-lts-announce/2024/12/msg00023.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VACQYG356OHUTD5WQGAQ4L2TTFTAV3SJ/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XODFRE2ZL64FICBJDOPWOLPTSSAI4U7X/https://www.oracle.com/security-alerts/cpuapr2022.htmlhttps://www.oracle.com/security-alerts/cpujul2022.htmlhttps://x-stream.github.io/CVE-2021-43859.html
2022-02-01
Published