Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| Red Hat · RHEL 7 enterprise_linux:7::client | xstream | 0:1.3.1-13.el7_9 |
| Red Hat · RHEL 7 enterprise_linux:7::client | xstream-javadoc | 0:1.3.1-13.el7_9 |
| Red Hat · RHEL 7 enterprise_linux:7::computenode | xstream | 0:1.3.1-13.el7_9 |
| Red Hat · RHEL 7 enterprise_linux:7::computenode | xstream-javadoc | 0:1.3.1-13.el7_9 |
| Red Hat · RHEL 7 enterprise_linux:7::server | xstream | 0:1.3.1-13.el7_9 |
| Red Hat · RHEL 7 enterprise_linux:7::server | xstream-javadoc | 0:1.3.1-13.el7_9 |
| Red Hat · RHEL 7 enterprise_linux:7::workstation | xstream | 0:1.3.1-13.el7_9 |
| Red Hat · RHEL 7 enterprise_linux:7::workstation | xstream-javadoc | 0:1.3.1-13.el7_9 |
Vulnerabilities 5
-
Medium 6.1CVE-2021-21346 EPSS 76%
XStream is vulnerable to an Arbitrary Code Execution attack
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input s…
-
Medium 6.1CVE-2021-21347 EPSS 14%
XStream is vulnerable to an Arbitrary Code Execution attack
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input s…
-
Medium 5.8
XStream is vulnerable to a Remote Command Execution attack
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker who has sufficient rights to execute commands of the host only by manipulating the processed inp…
-
Medium 5.3CVE-2021-21344 EPSS 76%
XStream is vulnerable to an Arbitrary Code Execution attack
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input s…
-
Medium 5.3CVE-2021-21350 EPSS 15%
XStream is vulnerable to an Arbitrary Code Execution attack
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to execute arbitrary code only by manipulating the processed input stream. No user is affected, …
References
-
article
https://access.redhat.com/security/updates/classification/#important
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1942554
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1942558
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1942578
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1942629
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1942637
-
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_1354.json
-
report
https://access.redhat.com/security/cve/CVE-2021-21344
-
advisory
https://www.cve.org/CVERecord?id=CVE-2021-21344
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2021-21344
-
report
https://access.redhat.com/security/cve/CVE-2021-21345
-
advisory
https://www.cve.org/CVERecord?id=CVE-2021-21345
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2021-21345
-
report
https://access.redhat.com/security/cve/CVE-2021-21346
-
advisory
https://www.cve.org/CVERecord?id=CVE-2021-21346
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2021-21346
-
report
https://access.redhat.com/security/cve/CVE-2021-21347
-
advisory
https://www.cve.org/CVERecord?id=CVE-2021-21347
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2021-21347
-
report
https://access.redhat.com/security/cve/CVE-2021-21350
-
advisory
https://www.cve.org/CVERecord?id=CVE-2021-21350
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2021-21350