Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
37 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact The vulnerability may allow a remote attacker to terminate the application with a stack overflow error resulting in a denial of service only by manipulating the processed input stream when XStream is configured to use the BinaryStreamDriver. Patches XStream 1.4.21 detects the manipulation in the binary input stream causing the the stack overflow and raises an InputManipulationException instead. Workarounds The only solution is to catch the StackOverflowError in the client code calling XStream if XStream is configured to use the BinaryStreamDriver. References See full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for CVE-2024-47072. Credits Alexis Challande of Trail Of Bits found and reported the issue to XStream and provided the required information to reproduce it.
Recommended action: Upgrade to 1.4.21 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The vulnerability may allow a remote attacker to terminate the application with a stack overflow error resulting in a denial of service only by manipulating the processed input stream. Patches XStream 1.4.20 handles the stack overflow and raises an InputManipulationException instead. Workarounds The only solution is to catch the StackOverflowError in the client code calling XStream. References See full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for CVE-2022-40151. Credits The vulnerability was discovered and reported by Henry Lin of the Google OSS-Fuzz team. For more information If you have any questions or comments about this advisory: Open an issue in XStream Contact us at XStream Google Group
Recommended action: Upgrade to 1.4.20 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The vulnerability may allow a remote attacker to terminate the application with a stack overflow error resulting in a denial of service only by manipulating the processed input stream. Patches XStream 1.4.20 handles the stack overflow and raises an InputManipulationException instead. Workarounds The attack uses the hash code implementation for collections and maps to force recursive hash calculation causing a stack overflow. Following types of the Java runtime are affected: - java.util.HashMap - java.util.HashSet - java.util.Hashtable - java.util.LinkedHashMap - java.util.LinkedHashSet - Other third party collection implementations that use their element's hash code may also be affected A simple solution is to catch the StackOverflowError in the client code calling XStream. If your object graph does not use referenced elements at all, you may simply set the NOREFERENCE mode: If your object graph contains neither a Hashtable, HashMap nor a HashSet (or one of the linked variants…
Recommended action: Upgrade to 1.4.20 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The vulnerability may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a payload resulting in a denial of service only by manipulating the processed input stream. Patches XStream 1.4.19 monitors and accumulates the time it takes to add elements to collections and throws an exception if a set threshold is exceeded. Workarounds The attack uses the hash code implementation for collections and maps to force an exponential calculation time due to highly recursive structures with in the collection or map. Following types of the Java runtime are affected in Java versions available in December 2021: - java.util.HashMap - java.util.HashSet - java.util.Hashtable - java.util.LinkedHashMap - java.util.LinkedHashSet - java.util.Stack (older Java revisions only) - java.util.Vector (older Java revisions only) - Other third party collection implementations that use their element's hash code may also be affected If your…
Recommended action: Upgrade to 1.4.19 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. A user is only affected if using the version out of the box with JDK 1.7u21 or below. However, this scenario can be adjusted easily to an external Xalan that works regardless of the version of the Java runtime. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. Patches XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose. Workarounds See workarounds for the different versions covering all CVEs. References See full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for CVE-2021-39139. Credits Lai Han of nsfocus security team found and reported the issue to XStream and provided the required information to reproduce it. For more…
Recommended action: Upgrade to 1.4.18 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The vulnerability may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a payload resulting in a denial of service only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. Patches XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose. Workarounds See workarounds for the different versions covering all CVEs. References See full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for CVE-2021-39140. Credits The vulnerability was discovered and reported by Lai Han of nsfocus security team. For more information If you have any questions or comments about this advisory: Open an issue in XStream Contact us at XStream Google Group
Recommended action: Upgrade to 1.4.18 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. Patches XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose. Workarounds See workarounds for the different versions covering all CVEs. References See full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for CVE-2021-39141. Credits Ceclin and YXXX from the Tencent Security Response Center found and reported the issue to XStream and provided the required information to reproduce it. For more information If you have any questions or comments about this advisory: Open an issue in XStream Contact us at XStream Google Group
Recommended action: Upgrade to 1.4.18 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The vulnerability may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. Patches XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose. Workarounds See workarounds for the different versions covering all CVEs. References See full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for CVE-2021-39144. Credits Ceclin and YXXX from the Tencent Security Response Center found and reported the issue to XStream and provided the required information to reproduce it. For more information If you have any questions or comments about this advisory: Open an issue in XStream Email us at XStream Google Group
Recommended action: Upgrade to 1.4.18 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. Patches XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose. Workarounds See workarounds for the different versions covering all CVEs. References See full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for CVE-2021-39145. Credits 李安诺 (Li4n0) from Alibaba Cloud Security Team and Smi1e of DBAPPSecurity WEBIN Lab found and reported the issue independently to XStream and provided the required information to reproduce it. For more information If you have any questions or comments about this advisory: Open an issue in XStream Contact us at XStream Google Group
Recommended action: Upgrade to 1.4.18 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. Patches XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose. Workarounds See workarounds for the different versions covering all CVEs. References See full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for CVE-2021-39146. Credits Ceclin and YXXX from the Tencent Security Response Center found and reported the issue to XStream and provided the required information to reproduce it. For more information If you have any questions or comments about this advisory: Open an issue in XStream Contact us at XStream Google Group
Recommended action: Upgrade to 1.4.18 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. Patches XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose. Workarounds See workarounds for the different versions covering all CVEs. References See full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for CVE-2021-39147. Credits wh1t3p1g from TSRC (Tencent Security Response Center) found and reported the issue to XStream and provided the required information to reproduce it. For more information If you have any questions or comments about this advisory: Open an issue in XStream Contact us at XStream Google Group
Recommended action: Upgrade to 1.4.18 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. Patches XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose. Workarounds See workarounds for the different versions covering all CVEs. References See full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for CVE-2021-39148. Credits wh1t3p1g from TSRC (Tencent Security Response Center) found and reported the issue to XStream and provided the required information to reproduce it. For more information If you have any questions or comments about this advisory: Open an issue in XStream Contact us at XStream Google Group
Recommended action: Upgrade to 1.4.18 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. Patches XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose. Workarounds See workarounds for the different versions covering all CVEs. References See full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for CVE-2021-39149. Credits Lai Han of NSFOCUS security team found and reported the issue to XStream and provided the required information to reproduce it. For more information If you have any questions or comments about this advisory: Open an issue in XStream Contact us at XStream Google Group
Recommended action: Upgrade to 1.4.18 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream with a Java runtime version 14 to 8. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. Patches If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.18. Workarounds See workarounds for the different versions covering all CVEs. References See full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for CVE-2021-39150. Credits Lai Han of NSFOCUS security team found and reported the issue to XStream and provided the required information to reproduce it. For more information If you have any questions or comments about this advisory: Open an issue in XStream Contact us at XStream Google Group
Recommended action: Upgrade to 1.4.18 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. Patches XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose. Workarounds See workarounds for the different versions covering all CVEs. References See full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for CVE-2021-39151. Credits Smi1e of DBAPPSecurity WEBIN Lab found and reported the issue to XStream and provided the required information to reproduce it. For more information If you have any questions or comments about this advisory: Open an issue in XStream Contact us at XStream Google Group
Recommended action: Upgrade to 1.4.18 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream with a Java runtime version 14 to 8. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. Patches If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.18. Workarounds See workarounds for the different versions covering all CVEs. References See full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for CVE-2021-39152. Credits m0d9 of the Security Team of Alibaba Cloud found and reported the issue to XStream and provided the required information to reproduce it. For more information If you have any questions or comments about this advisory: Open an issue in XStream Contact us at XStream Google Group
Recommended action: Upgrade to 1.4.18 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream, if using the version out of the box with Java runtime version 14 to 8 or with JavaFX installed. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. Patches XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose. Workarounds See workarounds for the different versions covering all CVEs. References See full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for CVE-2021-39153. Credits Ceclin and YXXX from the Tencent Security Response Center found and reported the issue to XStream and provided the required information to reproduce it. For more information If you have any questions or comments about this advisory: Open an issue in XStream…
Recommended action: Upgrade to 1.4.18 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. Patches XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose. Workarounds See workarounds for the different versions covering all CVEs. References See full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for CVE-2021-39154. Credits ka1n4t found and reported the issue to XStream and provided the required information to reproduce it. For more information If you have any questions or comments about this advisory: Open an issue in XStream Contact us at XStream Google Group
Recommended action: Upgrade to 1.4.18 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The vulnerability may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. Patches If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.17. Workarounds See workarounds for the different versions covering all CVEs. References See full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for CVE-2021-29505. Credits V3geB1rd, white hat hacker from Tencent Security Response Center found and reported the issue to XStream and provided the required information to reproduce it. For more information If you have any questions or comments about this advisory: Open an issue in XStream Email us at XStream Google Group
Recommended action: Upgrade to 1.4.17 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. Patches If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16. Workarounds See workarounds for the different versions covering all CVEs. References See full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for CVE-2021-21351. Credits wh1t3p1g G5-RD6@IIE found and reported the issue to XStream and provided the required information to reproduce it. For more information If you have any questions or comments about this advisory: Open an issue in XStream Contact us at XStream Google Group
Recommended action: Upgrade to 1.4.16 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The vulnerability may allow a remote attacker to execute arbitrary code only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. Patches If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16. Workarounds See workarounds for the different versions covering all CVEs. References See full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for CVE-2021-21350. Credits The vulnerability was discovered and reported by threedr3am. For more information If you have any questions or comments about this advisory: Open an issue in XStream Contact us at XStream Google Group
Recommended action: Upgrade to 1.4.16 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. Patches If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16. Workarounds See workarounds for the different versions covering all CVEs. References See full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for CVE-2021-21349. Credits The vulnerability was discovered and reported by threedr3am. For more information If you have any questions or comments about this advisory: Open an issue in XStream Contact us at XStream Google Group
Recommended action: Upgrade to 1.4.16 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The vulnerability may allow a remote attacker to occupy a thread that consumes maximum CPU time and will never return. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. Patches If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16. Workarounds See workarounds for the different versions covering all CVEs. References See full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for CVE-2021-21348. Credits The vulnerability was discovered and reported by threedr3am. For more information If you have any questions or comments about this advisory: Open an issue in XStream Contact us at XStream Google Group
Recommended action: Upgrade to 1.4.16 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. Patches If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16. Workarounds See workarounds for the different versions covering all CVEs. References See full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for CVE-2021-21347. Credits The vulnerability was discovered and reported by threedr3am. For more information If you have any questions or comments about this advisory: Open an issue in XStream Contact us at XStream Google Group
Recommended action: Upgrade to 1.4.16 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. Patches If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16. Workarounds See workarounds for the different versions covering all CVEs. References See full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for CVE-2021-21346. Credits wh1t3p1g G5-RD6@IIE found and reported the issue to XStream and provided the required information to reproduce it. For more information If you have any questions or comments about this advisory: Open an issue in XStream Contact us at XStream Google Group
Recommended action: Upgrade to 1.4.16 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.