Most recent entries from all

certfr-2021-avi-943 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan…

certfr-2021-avi-943

cnvd-2021-67825

EUVD-2026-30441

fkie_cve-2021-39146

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.

GHSA-p8pq-r894-fm8f — XStream is vulnerable to an Arbitrary Code Execution attack

Affected: Maven: com.thoughtworks.xstream:xstream

### Impact The vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types.

### Patches XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.

### Workarounds See [workarounds](https://x-stream.github.io/security.html#workaround) for the different versions covering all CVEs.

### References See full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for [CVE-2021-39146](https://x-stream.github.io/CVE-2021-39146.html).

### Credits Ceclin and YXXX from the Tencent Security Response Center found and reported the issue to XStream and provided the required information to reproduce it.

### For more information If you have any questions or comments about this advisory: * Open an issue in [XStream](https://github.com/x-stream/xstream/issues) * Contact us at [XStream Google Group](https://groups.google.com/group/xstream-user)

gsd-2021-39146

OESA-2021-1337 — xstream security update

Affected: openEuler:20.03-LTS-SP1: xstream, openEuler:20.03-LTS-SP2: xstream

XStream is a simple library to serialize objects to XML and back again. A high level facade is supplied that simplifies common use cases. Custom objects can be serialized without need for specifying mappings. Speed and low memory footprint are a crucial part of the design, making it suitable for large object graphs or systems with high message throughput. No information is duplicated that can be obtained via reflection. This results in XML that is easier to read for humans and more compact than native Java serialization. XStream serializes internal fields, including private and final. Supports non-public and inner classes. Classes are not required to have default constructor. Duplicate references encountered in the object-model will be maintained. Supports circular references. By implementing an interface, XStream can serialize directly to/from any tree structure (not just XML). Strategies can be registered allowing customization of how particular types are represented as XML. When an exception occurs due to malformed XML, detailed diagnostics are provided to help isolate and fix the problem. Security Fix(es): XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. A user is only affected if using the version out of the box with JDK 1.7u21 or below. However, this scenario can be adjust…

openSUSE-SU-2021:1401-1 — Security update for xstream

Security update for xstream

RHSA-2021:4767 — Red Hat Security Advisory: Red Hat Integration Camel Extensions for Quarkus GA security update

velocity: arbitrary code execution when attacker is able to modify templates RESTEasy: Caching routes in RootNode may result in DoS XStream: remote code execution due to insecure XML deserialization when relying on blocklists XStream: Server-Side Forgery Request vulnerability can be activated when unmarshalling XStream: arbitrary file deletion on the local host when unmarshalling jetty: buffer not correctly recycled in Gzip Request inflation jetty: request containing multiple Accept headers with a large number of "quality" parameters may lead to DoS bouncycastle: password bypass in OpenBSDBCrypt.checkPassword utility possible jackson-dataformat-cbor: Unchecked allocation of byte buffer can cause a java.lang.OutOfMemoryError exception undertow: potential security issue in flow control over HTTP/2 may lead to DOS wildfly-elytron: possible timing attack in ScramServer undertow: buffer leak on incoming websocket PONG message may lead to DoS resteasy: Error message exposes endpoint class information mongo-java-driver: client-side field level encryption not verifying KMS host name XStream: allow a remote attacker to cause DoS only by manipulating the processed input stream XStream: SSRF via crafted input stream XStream: arbitrary file deletion on the local host via crafted input stream XStream: Unsafe deserizaliation of javax.sql.rowset.BaseRowSet XStream: Unsafe deserizaliation of com.sun.corba.se.impl.activation.ServerTableEntry XStream: Unsafe deserizaliation of sun.swing.Swing…

SUSE-SU-2021:3476-1 — Security update for xstream

Security update for xstream

UBUNTU-CVE-2021-39146

Affected: Ubuntu:18.04:LTS: libxstream-java, Ubuntu:20.04:LTS: libxstream-java

WID-SEC-W-2023-0682 — Red Hat Enterprise Linux (xstream): Mehrere Schwachstellen

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux in der Komponente xstream ausnutzen, um beliebigen Programmcode mit den Rechten des Dienstes auszuführen, einen Denial of Service Zustand herzustellen und vertrauliche Informationen offenzulegen.