CVE-2021-29505

XStream is software for serializing Java objects to XML and back again. A vulnerability in XStream versions prior to 1.4.17 may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types is affected. The vulnerability is patched in version 1.4.17.

CVSS v3 8.8 HIGH
CVSS v2.0 6.5 MEDIUM

8.8^/10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.5^/10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:S/C:P/I:P/A:P

Exploitability : 8.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://github.com/x-stream/xstream/commit/24fac82191292c6ae25f94508d28b9823f83624f	Patch Third Party Advisory
https://github.com/x-stream/xstream/security/advisories/GHSA-7chv-rrw6-w6fc	Third Party Advisory
https://lists.apache.org/thread.html/r8ee51debf7fd184b6a6b020dc31df25118b0aa612885f12fbe77f04f%40%3Cdev.jmeter.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/07/msg00004.html	Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/
https://security.netapp.com/advisory/ntap-20210708-0007/	Third Party Advisory
https://www.debian.org/security/2021/dsa-5004	Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.html	Patch Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2022.html	Patch Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.html
https://www.oracle.com/security-alerts/cpuoct2021.html	Mailing List Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:xstream_project:xstream:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR	cpe:2.3:o:debian:debian_linux:9.0:::::::*
	cpe:2.3:o:debian:debian_linux:10.0:::::::*
	cpe:2.3:o:debian:debian_linux:11.0:::::::*

Configuration 3 (hide)

OR	cpe:2.3:o:fedoraproject:fedora:33:::::::*
	cpe:2.3:o:fedoraproject:fedora:34:::::::*
	cpe:2.3:o:fedoraproject:fedora:35:::::::*

Configuration 4 (hide)

OR	cpe:2.3:a:netapp:snapmanager:-:::::oracle::
	cpe:2.3:a:netapp:snapmanager:-:::::sap::

Configuration 5 (hide)

OR	cpe:2.3:a:oracle:banking_cash_management:14.2:::::::*
	cpe:2.3:a:oracle:banking_cash_management:14.3:::::::*
	cpe:2.3:a:oracle:banking_cash_management:14.5:::::::*
	cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.2.0:::::::*
	cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.3.0:::::::*
	cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.5.0:::::::*
	cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.2.0:::::::*
	cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.3.0:::::::*
	cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.5.0:::::::*
	cpe:2.3:a:oracle:banking_supply_chain_finance:14.2.0:::::::*
	cpe:2.3:a:oracle:banking_trade_finance_process_management:14.5.0:::::::*
	cpe:2.3:a:oracle:business_activity_monitoring:11.1.1.9.0:::::::*
	cpe:2.3:a:oracle:business_activity_monitoring:12.2.1.3.0:::::::*
	cpe:2.3:a:oracle:business_activity_monitoring:12.2.1.4.0:::::::*
	cpe:2.3:a:oracle:communications_brm_-_elastic_charging_engine:11.3:::::::*
	cpe:2.3:a:oracle:communications_brm_-_elastic_charging_engine:12.0:::::::*
	cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.4:::::::*
	cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.5:::::::*
	cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.0:::::::*
	cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.1:::::::*
	cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.2:::::::*
	cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0.0:::::::*
	cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0.6:::::::*
	cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0.4:::::::*
	cpe:2.3:a:oracle:retail_xstore_point_of_service:18.0.3:::::::*
	cpe:2.3:a:oracle:retail_xstore_point_of_service:19.0.2:::::::*
	cpe:2.3:a:oracle:retail_xstore_point_of_service:20.0.1:::::::*
	cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:::::::*
	cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0:::::::*
	cpe:2.3:a:oracle:webcenter_sites:12.2.1.3.0:::::::*
	cpe:2.3:a:oracle:webcenter_sites:12.2.1.4.0:::::::*

History

No history.

Information

Published : 2021-05-28 21:15

Updated : 2023-11-07 03:32

NVD link : CVE-2021-29505

Mitre link : CVE-2021-29505

CVE.ORG link : CVE-2021-29505

JSON object : View

Products Affected

xstream_project

xstream

oracle

banking_supply_chain_finance
enterprise_manager_ops_center
webcenter_sites
banking_cash_management
banking_credit_facilities_process_management
communications_brm_-_elastic_charging_engine
communications_unified_inventory_management
banking_trade_finance_process_management
retail_xstore_point_of_service
webcenter_portal
banking_corporate_lending_process_management
business_activity_monitoring

fedoraproject

fedora

debian

debian_linux

netapp

snapmanager

CWE

CWE-502

Deserialization of Untrusted Data

CWE-94

Improper Control of Generation of Code ('Code Injection')

{"id": "CVE-2021-29505", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.6}]}, "published": "2021-05-28T21:15:08.713", "references": [{"url": "https://github.com/x-stream/xstream/commit/24fac82191292c6ae25f94508d28b9823f83624f", "tags": ["Patch", "Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/x-stream/xstream/security/advisories/GHSA-7chv-rrw6-w6fc", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://lists.apache.org/thread.html/r8ee51debf7fd184b6a6b020dc31df25118b0aa612885f12fbe77f04f%40%3Cdev.jmeter.apache.org%3E", "source": "security-advisories@github.com"}, {"url": "https://lists.debian.org/debian-lts-announce/2021/07/msg00004.html", "tags": ["Mailing List", "Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/", "source": "security-advisories@github.com"}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/", "source": "security-advisories@github.com"}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/", "source": "security-advisories@github.com"}, {"url": "https://security.netapp.com/advisory/ntap-20210708-0007/", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://www.debian.org/security/2021/dsa-5004", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://www.oracle.com/security-alerts/cpuapr2022.html", "tags": ["Patch", "Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://www.oracle.com/security-alerts/cpujan2022.html", "tags": ["Patch", "Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://www.oracle.com/security-alerts/cpujul2022.html", "source": "security-advisories@github.com"}, {"url": "https://www.oracle.com/security-alerts/cpuoct2021.html", "tags": ["Mailing List", "Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-502"}, {"lang": "en", "value": "CWE-94"}]}, {"type": "Secondary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-502"}]}], "descriptions": [{"lang": "en", "value": "XStream is software for serializing Java objects to XML and back again. A vulnerability in XStream versions prior to 1.4.17 may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types is affected. The vulnerability is patched in version 1.4.17."}, {"lang": "es", "value": "XStream es un software para serializar objetos Java a XML y viceversa. Una vulnerabilidad en las versiones de XStream anteriores a la versi\u00f3n 1.4.17 puede permitir a un atacante remoto que tenga derechos suficientes ejecutar comandos del host s\u00f3lo manipulando el flujo de entrada procesado. Ning\u00fan usuario que haya seguido la recomendaci\u00f3n de configurar el marco de seguridad de XStream con una lista blanca limitada a los tipos m\u00ednimos necesarios est\u00e1 afectado. La vulnerabilidad est\u00e1 parcheada en la versi\u00f3n 1.4.17"}], "lastModified": "2023-11-07T03:32:38.837", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:xstream_project:xstream:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0B52FEE1-8DD4-470E-BB3E-AEB351910103", "versionEndExcluding": "1.4.17"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DEECE5FC-CACF-4496-A3E7-164736409252"}, {"criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73"}, {"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E460AA51-FCDA-46B9-AE97-E6676AA5E194"}, {"criteria": "cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A930E247-0B43-43CB-98FF-6CE7B8189835"}, {"criteria": "cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "80E516C0-98A4-4ADE-B69F-66A772E2BAAA"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:oracle:*:*", "vulnerable": true, "matchCriteriaId": "26A2B713-7D6D-420A-93A4-E0D983C983DF"}, {"criteria": "cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:sap:*:*", "vulnerable": true, "matchCriteriaId": "64DE38C8-94F1-4860-B045-F33928F676A8"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:oracle:banking_cash_management:14.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3DBD5E57-CC8B-4180-ACBD-BD067D0801D2"}, {"criteria": "cpe:2.3:a:oracle:banking_cash_management:14.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "071E67EC-DC5A-4BD1-AC8F-6266E6436FF0"}, {"criteria": "cpe:2.3:a:oracle:banking_cash_management:14.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "626C6209-8BC3-4954-BF0C-51500582457E"}, {"criteria": "cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.2.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0CF9A061-2421-426D-9854-0A4E55B2961D"}, {"criteria": "cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.3.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F95EDC3D-54BB-48F9-82F2-7CCF335FCA78"}, {"criteria": "cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.5.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B72B735F-4E52-484A-9C2C-23E6E2070385"}, {"criteria": "cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.2.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8B36A1D4-F391-4EE3-9A65-0A10568795BA"}, {"criteria": "cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.3.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "55116032-AAD1-4FEA-9DA8-2C4CBD3D3F61"}, {"criteria": "cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.5.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0275F820-40BE-47B8-B167-815A55DF578E"}, {"criteria": "cpe:2.3:a:oracle:banking_supply_chain_finance:14.2.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6A8420D4-AAF1-44AA-BF28-48EE3ED310B9"}, {"criteria": "cpe:2.3:a:oracle:banking_trade_finance_process_management:14.5.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B185C1EA-71E6-4972-8637-08A33CC00841"}, {"criteria": "cpe:2.3:a:oracle:business_activity_monitoring:11.1.1.9.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CC723E79-8F35-417B-B9D9-6A707F74C1EE"}, {"criteria": "cpe:2.3:a:oracle:business_activity_monitoring:12.2.1.3.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5700C2E9-5FF2-48EF-AD85-3C03EDA76536"}, {"criteria": "cpe:2.3:a:oracle:business_activity_monitoring:12.2.1.4.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BA8461A2-428C-4817-92A9-0C671545698D"}, {"criteria": "cpe:2.3:a:oracle:communications_brm_-_elastic_charging_engine:11.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "512E0604-4D40-49CE-8142-89379A226913"}, {"criteria": "cpe:2.3:a:oracle:communications_brm_-_elastic_charging_engine:12.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F5726AE4-4F63-4793-8948-0546DAA2D50D"}, {"criteria": "cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0D299528-8EF0-49AF-9BDE-4B6C6B1DA36C"}, {"criteria": "cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "17A91FD9-9F77-42D3-A4D9-48BC7568ADE1"}, {"criteria": "cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "539DA24F-E3E0-4455-84C6-A9D96CD601B3"}, {"criteria": "cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A7637F8B-15F1-42E2-BE18-E1FF7C66587D"}, {"criteria": "cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E43D793A-7756-4D58-A8ED-72DC4EC9CEA7"}, {"criteria": "cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B095CC03-7077-4A58-AB25-CC5380CDCE5A"}, {"criteria": "cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "490B2C44-CECD-4551-B04F-4076D0E053C7"}, {"criteria": "cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DEC41EB8-73B4-4BDF-9321-F34EC0BAF9E6"}, {"criteria": "cpe:2.3:a:oracle:retail_xstore_point_of_service:18.0.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "48EFC111-B01B-4C34-87E4-D6B2C40C0122"}, {"criteria": "cpe:2.3:a:oracle:retail_xstore_point_of_service:19.0.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "073FEA23-E46A-4C73-9D29-95CFF4F5A59D"}, {"criteria": "cpe:2.3:a:oracle:retail_xstore_point_of_service:20.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A69FB468-EAF3-4E67-95E7-DF92C281C1F1"}, {"criteria": "cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D6A4F71A-4269-40FC-8F61-1D1301F2B728"}, {"criteria": "cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5A502118-5B2B-47AE-82EC-1999BD841103"}, {"criteria": "cpe:2.3:a:oracle:webcenter_sites:12.2.1.3.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D551CAB1-4312-44AA-BDA8-A030817E153A"}, {"criteria": "cpe:2.3:a:oracle:webcenter_sites:12.2.1.4.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "174A6D2E-E42E-4C92-A194-C6A820CD7EF4"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}

8.8 /10