CVE-2021-39152
Published: 23 August 2021
XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream with a Java runtime version 14 to 8. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the [Security Framework](https://x-stream.github.io/security.html#framework), you will have to use at least version 1.4.18.
Notes
| Author | Note |
|---|---|
| sahnaseredini | for `trusty` and `xenial`, the code is not present and the available pocs cannot be exploited |
Priority
Status
| Package | Release | Status |
|---|---|---|
|
libxstream-java Launchpad, Ubuntu, Debian |
bionic |
Released
(1.4.11.1-1+deb10u4build0.18.04.1)
|
| focal |
Released
(1.4.11.1-1ubuntu0.3)
|
|
| hirsute |
Ignored
(end of life)
|
|
| impish |
Ignored
(end of life)
|
|
| jammy |
Not vulnerable
(1.4.18-1)
|
|
| kinetic |
Not vulnerable
(1.4.18-1)
|
|
| lunar |
Not vulnerable
(1.4.18-1)
|
|
| trusty |
Not vulnerable
(code not present)
|
|
| upstream |
Needs triage
|
|
| xenial |
Not vulnerable
(code not present)
|
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score | 8.5 |
| Attack vector | Network |
| Attack complexity | High |
| Privileges required | Low |
| User interaction | None |
| Scope | Changed |
| Confidentiality | High |
| Integrity impact | High |
| Availability impact | High |
| Vector | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H |