High · published August 23, 2021
XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.
| Product | Versions | Fixed in |
|---|---|---|
| xstream/xstream | < 1.4.18 | 1.4.18 |
| fedoraproject/fedora | all versions | — |
| fedoraproject/fedora | all versions | — |
| fedoraproject/fedora | all versions | — |
| debian/debian_linux | all versions | — |
| debian/debian_linux | all versions | — |
| debian/debian_linux | all versions | — |
| netapp/snapmanager | all versions | — |
| netapp/snapmanager | all versions | — |
| oracle/retail_xstore_point_of_service | all versions | — |
| oracle/business_activity_monitoring | all versions | — |
| oracle/commerce_guided_search | all versions | — |
| oracle/communications_billing_and_revenue_management_elastic_charging_engine | all versions | — |
| oracle/communications_billing_and_revenue_management_elastic_charging_engine | all versions | — |
| oracle/communications_cloud_native_core_automated_test_suite | all versions | — |
| oracle/communications_cloud_native_core_binding_support_function | all versions | — |
| oracle/communications_cloud_native_core_policy | all versions | — |
| oracle/communications_unified_inventory_management | all versions | — |
| oracle/communications_unified_inventory_management | all versions | — |
| oracle/communications_unified_inventory_management | all versions | — |
| oracle/communications_unified_inventory_management | all versions | — |
| oracle/communications_unified_inventory_management | all versions | — |
| oracle/retail_xstore_point_of_service | all versions | — |
| oracle/retail_xstore_point_of_service | all versions | — |
| oracle/retail_xstore_point_of_service | all versions | — |
| oracle/retail_xstore_point_of_service | all versions | — |
| oracle/utilities_framework | all versions | — |
| oracle/utilities_framework | all versions | — |
| oracle/utilities_framework | all versions | — |
| oracle/utilities_framework | all versions | — |
| oracle/utilities_framework | all versions | — |
| oracle/utilities_framework | all versions | — |
| oracle/utilities_framework | all versions | — |
| oracle/utilities_testing_accelerator | all versions | — |
| oracle/webcenter_portal | all versions | — |
| oracle/webcenter_portal | all versions | — |