Medium · published March 23, 2021
CVSS calls it medium at 5.3. It sits in the 99.5th percentile for exploit probability.
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.
| Product | Versions | Fixed in |
|---|---|---|
| netapp/oncommand_insight | all versions | — |
| apache/activemq | < 5.15.14 | 5.15.14 |
| apache/activemq | all versions | — |
| apache/activemq | all versions | — |
| apache/jmeter | < 5.5 | 5.5 |
| xstream/xstream | < 1.4.16 | 1.4.16 |
| debian/debian_linux | all versions | — |
| debian/debian_linux | all versions | — |
| debian/debian_linux | all versions | — |
| fedoraproject/fedora | all versions | — |
| fedoraproject/fedora | all versions | — |
| fedoraproject/fedora | all versions | — |
| oracle/banking_enterprise_default_management | all versions | — |
| oracle/banking_enterprise_default_management | all versions | — |
| oracle/banking_platform | all versions | — |
| oracle/banking_platform | all versions | — |
| oracle/banking_platform | all versions | — |
| oracle/banking_platform | all versions | — |
| oracle/banking_virtual_account_management | all versions | — |
| oracle/banking_virtual_account_management | all versions | — |
| oracle/banking_virtual_account_management | all versions | — |
| oracle/business_activity_monitoring | all versions | — |
| oracle/business_activity_monitoring | all versions | — |
| oracle/business_activity_monitoring | all versions | — |
| oracle/communications_billing_and_revenue_management_elastic_charging_engine | all versions | — |
| oracle/communications_policy_management | all versions | — |
| oracle/communications_unified_inventory_management | all versions | — |
| oracle/communications_unified_inventory_management | all versions | — |
| oracle/communications_unified_inventory_management | all versions | — |
| oracle/communications_unified_inventory_management | all versions | — |
| oracle/communications_unified_inventory_management | all versions | — |
| oracle/mysql_server | ≤ 5.7.36 | — |
| oracle/mysql_server | ≥ 8.0.0, ≤ 8.0.27 | — |
| oracle/retail_xstore_point_of_service | all versions | — |
| oracle/retail_xstore_point_of_service | all versions | — |
| oracle/retail_xstore_point_of_service | all versions | — |
| oracle/retail_xstore_point_of_service | all versions | — |
| oracle/webcenter_portal | all versions | — |
| oracle/webcenter_portal | all versions | — |
| oracle/webcenter_portal | all versions | — |