Skip to content
OpenAdvisories
High ALAS2-2021-1698 1 CVE

Important: xstream security update (Amazon Linux 2)

Published Aug 4, 2021 · Updated Aug 5, 2021

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-29505: A flaw was found in XStream. By manipulating the processed input stream, a remote attacker may be able to obtain sufficient rights to execute commands. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. 1966735: CVE-2021-29505 XStream: remote command execution attack by manipulating the processed input stream

Fixed packages 2

ReleasePackageFixed in
Amazon Linux · 2 xstream 0:1.3.1-14.amzn2
Amazon Linux · 2 xstream-javadoc 0:1.3.1-14.amzn2

Vulnerabilities 1

  • High 7.5
    CVE-2021-29505 Public exploit Scanner template EPSS 77%

    XStream is vulnerable to a Remote Command Execution attack

    XStream is software for serializing Java objects to XML and back again. A vulnerability in XStream versions prior to 1.4.17 may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No u…

    x-stream xstream libxstream-java com.thoughtworks.xstream:xstream Debian Ubuntu Maven

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-29505.html