Skip to content
OpenAdvisories
High RHSA-2021:2683 1 CVE

Red Hat Security Advisory: xstream security update

Published Sep 16, 2024 · Updated Oct 8, 2026

Ecosystem: Red Hat

Fixed packages 8

ReleasePackageFixed in
Red Hat · RHEL 7 enterprise_linux:7::client xstream 0:1.3.1-14.el7_9
Red Hat · RHEL 7 enterprise_linux:7::client xstream-javadoc 0:1.3.1-14.el7_9
Red Hat · RHEL 7 enterprise_linux:7::computenode xstream 0:1.3.1-14.el7_9
Red Hat · RHEL 7 enterprise_linux:7::computenode xstream-javadoc 0:1.3.1-14.el7_9
Red Hat · RHEL 7 enterprise_linux:7::server xstream 0:1.3.1-14.el7_9
Red Hat · RHEL 7 enterprise_linux:7::server xstream-javadoc 0:1.3.1-14.el7_9
Red Hat · RHEL 7 enterprise_linux:7::workstation xstream 0:1.3.1-14.el7_9
Red Hat · RHEL 7 enterprise_linux:7::workstation xstream-javadoc 0:1.3.1-14.el7_9

Vulnerabilities 1

  • High 7.5
    CVE-2021-29505 Public exploit Scanner template EPSS 77%

    XStream is vulnerable to a Remote Command Execution attack

    XStream is software for serializing Java objects to XML and back again. A vulnerability in XStream versions prior to 1.4.17 may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No u…

    x-stream xstream libxstream-java com.thoughtworks.xstream:xstream Debian Ubuntu Maven

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1966735
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_2683.json
  • report
    https://access.redhat.com/security/cve/CVE-2021-29505
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2021-29505
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2021-29505
  • article
    https://github.com/x-stream/xstream/security/advisories/GHSA-7chv-rrw6-w6fc
  • article
    https://x-stream.github.io/CVE-2021-29505.html