Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
37 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact The vulnerability may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. Patches If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16. Workarounds See workarounds for the different versions covering all CVEs. References See full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for CVE-2021-21345. Credits 钟潦贵 (Liaogui Zhong) found and reported the issue to XStream and provided the required information to reproduce it. For more information If you have any questions or comments about this advisory: Open an issue in XStream Contact us at XStream Google Group
Recommended action: Upgrade to 1.4.16 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. Patches If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16. Workarounds See workarounds for the different versions covering all CVEs. References See full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for CVE-2021-21344. Credits 钟潦贵 (Liaogui Zhong) found and reported the issue to XStream and provided the required information to reproduce it. For more information If you have any questions or comments about this advisory: Open an issue in XStream Contact us at XStream Google Group
Recommended action: Upgrade to 1.4.16 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The processed stream at unmarshalling time contains type information to recreate the formerly written objects. XStream creates therefore new instances based on these type information. An attacker can manipulate the processed input stream and replace or inject objects, that result in the deletion of a file on the local host. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. Patches If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16. Workarounds See workarounds for the different versions covering all CVEs. References See full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for CVE-2021-21343. Credits 钟潦贵 (Liaogui Zhong) found and reported the issue to XStream and provided the required information to reproduce it. For more information If you have any questions or…
Recommended action: Upgrade to 1.4.16 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The processed stream at unmarshalling time contains type information to recreate the formerly written objects. XStream creates therefore new instances based on these type information. An attacker can manipulate the processed input stream and replace or inject objects, that result in a server-side forgery request. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. Patches If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16 Workarounds See workarounds for the different versions covering all CVEs. References See full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for CVE-2021-21342. Credits 钟潦贵 (Liaogui Zhong) found and reported the issue to XStream and provided the required information to reproduce it. For more information If you have any questions or comments…
Recommended action: Upgrade to 1.4.16 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The vulnerability may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a payload resulting in a denial of service only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. Patches If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16. Workarounds See workarounds for the different versions covering all CVEs. References See full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for CVE-2021-21341. Credits The vulnerability was discovered and reported by threedr3am. For more information If you have any questions or comments about this advisory: Open an issue in XStream Contact us at XStream Google Group
Recommended action: Upgrade to 1.4.16 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream. Patches If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.15. Workarounds The reported vulnerability does not exist running Java 15 or higher. No user is affected, who followed the recommendation to setup XStream's Security Framework with a whitelist! Anyone relying on XStream's default blacklist can immediately switch to a whilelist for the allowed types to avoid the vulnerability. Users of XStream 1.4.14 or below who still insist to use XStream default blacklist - despite that clear recommendation - can use a workaround depending on their version in use. Users of XStream 1.4.14 can simply add two lines to XStream's setup code: Users of XStream 1.4.14 to 1.4.13 can simply add three lines to XStream's setup code: Users of XStream 1.4.12 to 1.4.7 who…
Recommended action: Upgrade to 1.4.15 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The vulnerability may allow a remote attacker to delete arbitrary know files on the host as log as the executing process has sufficient rights only by manipulating the processed input stream. Patches If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.15. Workarounds The reported vulnerability does only exist with a JAX-WS runtime on the classpath. No user is affected, who followed the recommendation to setup XStream's Security Framework with a whitelist! Anyone relying on XStream's default blacklist can immediately switch to a whilelist for the allowed types to avoid the vulnerability. Users of XStream 1.4.14 or below who still insist to use XStream default blacklist - despite that clear recommendation - can use a workaround depending on their version in use. Users of XStream 1.4.14 can simply add two lines to XStream's setup code: Users of XStream 1.4.14 to 1.4.13 can simply add three lines to XStream's setup code:…
Recommended action: Upgrade to 1.4.15 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream. Patches If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.14. Workarounds No user is affected, who followed the recommendation to setup XStream's Security Framework with a whitelist! Anyone relying on XStream's default blacklist can immediately switch to a whilelist for the allowed types to avoid the vulnerability. Users of XStream 1.4.13 or below who still want to use XStream default blacklist can use a workaround depending on their version in use. Users of XStream 1.4.13 can simply add two lines to XStream's setup code: Users of XStream 1.4.12 to 1.4.7 who want to use XStream with a black list will have to setup such a list from scratch and deny at least the following types: javax.imageio.ImageIO$ContainsFilter, java.beans.EventHandler, java.lang.ProcessBuilder, java.lang.Void and void.…
Recommended action: Upgrade to 1.4.14-java7 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
XStream through 1.4.9, when a certain denyTypes workaround is not used, mishandles attempts to create an instance of the primitive type 'void' during unmarshalling, leading to a remote application crash, as demonstrated by an xstream.fromXML("<void/") call.
Recommended action: Upgrade to 1.4.10 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Multiple XML external entity (XXE) vulnerabilities in the (1) Dom4JDriver, (2) DomDriver, (3) JDomDriver, (4) JDom2Driver, (5) SjsxpDriver, (6) StandardStaxDriver, and (7) WstxDriver drivers in XStream before 1.4.9 allow remote attackers to read arbitrary files via a crafted XML document.
Recommended action: Upgrade to 1.4.9 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw. If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when unmarshalling XML or any supported format. e.g. JSON. (regression of CVE-2013-7285)
Recommended action: Upgrade to 1.4.11 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. e.g. JSON.
Recommended action: Upgrade to 1.4.11 or 1.4.7 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.