Your submission was sent successfully! Close

You have successfully unsubscribed! Close

Thank you for signing up for our newsletter!
In these regular emails you will find the latest updates about Ubuntu and upcoming events where you can meet our team.Close

CVE-2021-39141

Published: 23 August 2021

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.

Notes

AuthorNote
sahnaseredini
for `trusty` and `xenial`, the code is not present and the
available pocs cannot be exploited

Priority

Medium

Cvss 3 Severity Score

8.5

Score breakdown

Status

Package Release Status
libxstream-java
Launchpad, Ubuntu, Debian
impish Ignored
(end of life)
jammy Not vulnerable
(1.4.18-1)
kinetic Not vulnerable
(1.4.18-1)
lunar Not vulnerable
(1.4.18-1)
upstream Needs triage

xenial Not vulnerable
(code not present)
hirsute Ignored
(end of life)
bionic
Released (1.4.11.1-1+deb10u4build0.18.04.1)
focal
Released (1.4.11.1-1ubuntu0.3)
trusty Not vulnerable
(code not present)

Severity score breakdown

Parameter Value
Base score 8.5
Attack vector Network
Attack complexity High
Privileges required Low
User interaction None
Scope Changed
Confidentiality High
Integrity impact High
Availability impact High
Vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H