Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| Red Hat · RHEL 7 enterprise_linux:7::client | xstream | 0:1.3.1-16.el7_9 |
| Red Hat · RHEL 7 enterprise_linux:7::client | xstream-javadoc | 0:1.3.1-16.el7_9 |
| Red Hat · RHEL 7 enterprise_linux:7::computenode | xstream | 0:1.3.1-16.el7_9 |
| Red Hat · RHEL 7 enterprise_linux:7::computenode | xstream-javadoc | 0:1.3.1-16.el7_9 |
| Red Hat · RHEL 7 enterprise_linux:7::server | xstream | 0:1.3.1-16.el7_9 |
| Red Hat · RHEL 7 enterprise_linux:7::server | xstream-javadoc | 0:1.3.1-16.el7_9 |
| Red Hat · RHEL 7 enterprise_linux:7::workstation | xstream | 0:1.3.1-16.el7_9 |
| Red Hat · RHEL 7 enterprise_linux:7::workstation | xstream-javadoc | 0:1.3.1-16.el7_9 |
Vulnerabilities 14
-
High 8.5
XStream is vulnerable to a Remote Command Execution attack
XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affec…
KEV Mar 10, 2023 -
High 8.5
XStream is vulnerable to an Arbitrary Code Execution attack
XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. A user is only a…
-
High 8.5
XStream is vulnerable to an Arbitrary Code Execution attack
XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affec…
-
High 8.5
XStream is vulnerable to an Arbitrary Code Execution attack
XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affec…
-
High 8.5
XStream is vulnerable to an Arbitrary Code Execution attack
XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affec…
-
High 8.5
XStream is vulnerable to an Arbitrary Code Execution attack
XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affec…
-
High 8.5
XStream is vulnerable to an Arbitrary Code Execution attack
XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affec…
-
High 8.5
XStream is vulnerable to an Arbitrary Code Execution attack
XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affec…
-
High 8.5
A Server-Side Forgery Request vulnerability in XStream via PriorityQueue unmarshaling
XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream…
-
High 8.5
XStream is vulnerable to an Arbitrary Code Execution attack
XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affec…
-
High 8.5
A Server-Side Forgery Request vulnerability in XStream via HashMap unmarshaling
XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream…
-
High 8.5
XStream is vulnerable to an Arbitrary Code Execution attack
XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream, if using the ver…
-
High 8.5
XStream is vulnerable to an Arbitrary Code Execution attack
XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affec…
-
Medium 6.5
XStream can cause a Denial of Service
XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a payload resulting …
References
-
article
https://access.redhat.com/security/updates/classification/#important
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1997763
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1997765
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1997769
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1997772
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1997775
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1997777
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1997779
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1997781
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1997784
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1997786
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1997791
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1997793
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1997795
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1997801
-
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_3956.json
-
report
https://access.redhat.com/security/cve/CVE-2021-39139
-
advisory
https://www.cve.org/CVERecord?id=CVE-2021-39139
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2021-39139
-
article
https://github.com/x-stream/xstream/security/advisories/GHSA-64xx-cq4q-mf44
-
report
https://access.redhat.com/security/cve/CVE-2021-39140
-
advisory
https://www.cve.org/CVERecord?id=CVE-2021-39140
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2021-39140
-
article
https://github.com/x-stream/xstream/security/advisories/GHSA-6wf9-jmg9-vxcc
-
report
https://access.redhat.com/security/cve/CVE-2021-39141
-
advisory
https://www.cve.org/CVERecord?id=CVE-2021-39141
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2021-39141
-
article
https://github.com/x-stream/xstream/security/advisories/GHSA-g5w6-mrj7-75h2
-
report
https://access.redhat.com/security/cve/CVE-2021-39144
-
advisory
https://www.cve.org/CVERecord?id=CVE-2021-39144
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2021-39144
-
article
https://github.com/x-stream/xstream/security/advisories/GHSA-j9h8-phrw-h4fh
-
article
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
-
report
https://access.redhat.com/security/cve/CVE-2021-39145
-
advisory
https://www.cve.org/CVERecord?id=CVE-2021-39145
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2021-39145
-
article
https://github.com/x-stream/xstream/security/advisories/GHSA-8jrj-525p-826v
-
report
https://access.redhat.com/security/cve/CVE-2021-39146
-
advisory
https://www.cve.org/CVERecord?id=CVE-2021-39146