Skip to content
OpenAdvisories
High 1 exploited CVE ALAS2-2021-1729 14 CVEs

Important: xstream security update (Amazon Linux 2)

Published Dec 8, 2021 · Updated Dec 9, 2021

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-39154: A flaw was found in xstream, a simple library used to serialize objects to XML and back again. This flaw allows a remote attacker to load and execute arbitrary code from a remote host by manipulating the processed input stream. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. 1997801: CVE-2021-39154 xstream: Arbitrary code execution via unsafe deserialization of javax.swing.UIDefaults$ProxyLazyValue CVE-2021-39153: A flaw was found in xstream, a simple library used to serialize objects to XML and back again. This flaw allows a remote attacker to load and execute arbitrary code from a remote host by manipulating the processed input stream. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. 1997795: CVE-2021-39153 xstream: Arbitrary code execution via unsafe deserialization of Xalan xsltc.trax.TemplatesImpl CVE-2021-39152: A flaw was found in xstream, a simple library used to serialize objects to XML and back again. This flaw allows a remote attacker to request data from internal resources that are not publicly available by manipulating the processed input stream with Java runtime versions 14 to 8. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. 1997793: CVE-2021-39152 xstream: Server-side request forgery (SSRF) via unsafe deserialization of jdk.nashorn.internal.runtime.Source$URLData CVE-2021-39151: A flaw was found in xstream, a simple library used to serialize objects to XML and back again. This flaw allows a remote attacker to load and execute arbitrary code from a remote host by manipulating the processed input stream. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. 1997791: CVE-2021-39151 xstream: Arbitrary code execution via unsafe deserialization of com.sun.jndi.ldap.LdapBindingEnumeration CVE-2021-39150: A flaw was found in xstream, a simple library used to serialize objects to XML and back again. This flaw allows a remote attacker to request data from internal resources that are not publicly available by manipulating the processed input stream with Java runtime versions 14 to 8. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. 1997786: CVE-2021-39150 xstream: Server-side request forgery (SSRF) via unsafe deserialization of com.sun.xml.internal.ws.client.sei.* CVE-2021-39149: A flaw was found in xstream, a simple library used to serialize objects to XML and back again. This flaw allows a remote attacker to load and execute arbitrary code from a remote host by manipulating the processed input stream. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. 1997784: CVE-2021-39149 xstream: Arbitrary code execution via unsafe deserialization of com.sun.corba.* CVE-2021-39148: A flaw was found in xstream, a simple library used to serialize objects to XML and back again. This flaw allows a remote attacker to load and execute arbitrary code from a remote host by manipulating the processed input stream. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. 1997781: CVE-2021-39148 xstream: Arbitrary code execution via unsafe deserialization of com.sun.jndi.toolkit.dir.ContextEnumerator CVE-2021-39147: A flaw was found in xstream, a simple library used to serialize objects to XML and back again. This flaw allows a remote attacker to load and execute arbitrary code from a remote host by manipulating the processed input stream. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. 1997779: CVE-2021-39147 xstream: Arbitrary code execution via unsafe deserialization of com.sun.jndi.ldap.LdapSearchEnumeration CVE-2021-39146: A flaw was found in xstream, a simple library used to serialize objects to XML and back again. This flaw allows a remote attacker to load and execute arbitrary code from a remote host by manipulating the processed input stream. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. 1997777: CVE-2021-39146 xstream: Arbitrary code execution via unsafe deserialization of javax.swing.UIDefaults$ProxyLazyValue CVE-2021-39145: A flaw was found in xstream, a simple library used to serialize objects to XML and back again. This flaw allows a remote attacker to load and execute arbitrary code from a remote host by manipulating the processed input stream. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. 1997775: CVE-2021-39145 xstream: Arbitrary code execution via unsafe deserialization of com.sun.jndi.ldap.LdapBindingEnumeration CVE-2021-39144: A flaw was found in xstream, a simple library used to serialize objects to XML and back again. This flaw allows a remote attacker to load and execute arbitrary code from a remote host by manipulating the processed input stream. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. 1997772: CVE-2021-39144 xstream: Arbitrary code execution via unsafe deserialization of sun.tracing.* CVE-2021-39141: A flaw was found in xstream, a simple library used to serialize objects to XML and back again. This flaw allows a remote attacker to load and execute arbitrary code from a remote host by manipulating the processed input stream. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. 1997769: CVE-2021-39141 xstream: Arbitrary code execution via unsafe deserialization of com.sun.xml.internal.ws.client.sei.* CVE-2021-39140: XStream is a simple library to serialize objects to XML a

Fixed packages 2

ReleasePackageFixed in
Amazon Linux · 2 xstream 0:1.3.1-16.amzn2
Amazon Linux · 2 xstream-javadoc 0:1.3.1-16.amzn2

Vulnerabilities 14

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-39139.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-39140.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-39141.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-39144.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-39145.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-39146.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-39147.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-39148.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-39149.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-39150.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-39151.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-39152.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-39153.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-39154.html