Skip to content
OpenAdvisories
High ELSA-2021-2683 1 CVE

Important: xstream security update (Oracle Linux 7)

Published Jul 13, 2021 · Updated Jul 13, 2021

Ecosystem: Oracle Linux

Summary

[1.3.1-14]
- Fix remote code execution vulnerability
- Resolves: CVE-2021-29505

Fixed packages 2

ReleasePackageFixed in
Oracle Linux · 7 xstream 0:1.3.1-14.el7_9
Oracle Linux · 7 xstream-javadoc 0:1.3.1-14.el7_9

Vulnerabilities 1

  • High 7.5
    CVE-2021-29505 Public exploit Scanner template EPSS 77%

    XStream is vulnerable to a Remote Command Execution attack

    XStream is software for serializing Java objects to XML and back again. A vulnerability in XStream versions prior to 1.4.17 may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No u…

    x-stream xstream libxstream-java com.thoughtworks.xstream:xstream Debian Ubuntu Maven