CVE - CVE-2021-21341

CVE-ID
CVE-2021-21341	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is vulnerability which may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a payload resulting in a denial of service only by manipulating the processed input stream. No user is affected who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
CONFIRM:https://github.com/x-stream/xstream/security/advisories/GHSA-2p3x-qw9c-25hh URL:https://github.com/x-stream/xstream/security/advisories/GHSA-2p3x-qw9c-25hh CONFIRM:https://security.netapp.com/advisory/ntap-20210430-0002/ URL:https://security.netapp.com/advisory/ntap-20210430-0002/ DEBIAN:DSA-5004 URL:https://www.debian.org/security/2021/dsa-5004 FEDORA:FEDORA-2021-5e376c0ed9 URL:https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/ FEDORA:FEDORA-2021-d894ca87dc URL:https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/ FEDORA:FEDORA-2021-fbad11014a URL:https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/ MISC:http://x-stream.github.io/changes.html#1.4.16 URL:http://x-stream.github.io/changes.html#1.4.16 MISC:https://www.oracle.com//security-alerts/cpujul2021.html URL:https://www.oracle.com//security-alerts/cpujul2021.html MISC:https://www.oracle.com/security-alerts/cpujan2022.html URL:https://www.oracle.com/security-alerts/cpujan2022.html MISC:https://www.oracle.com/security-alerts/cpuoct2021.html URL:https://www.oracle.com/security-alerts/cpuoct2021.html MISC:https://x-stream.github.io/CVE-2021-21341.html URL:https://x-stream.github.io/CVE-2021-21341.html MISC:https://x-stream.github.io/security.html#workaround URL:https://x-stream.github.io/security.html#workaround MLIST:[activemq-users] 20210427 Release date for ActiveMQ v5.16.2 to fix CVEs URL:https://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae655414d23ed0dd@%3Cusers.activemq.apache.org%3E MLIST:[debian-lts-announce] 20210403 [SECURITY] [DLA 2616-1] libxstream-java security update URL:https://lists.debian.org/debian-lts-announce/2021/04/msg00002.html MLIST:[jmeter-dev] 20210406 [GitHub] [jmeter] sseide opened a new pull request #655: update x-stream to 1.4.16 (from 1.4.15) URL:https://lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fac48b425c6e16b0@%3Cdev.jmeter.apache.org%3E
Assigning CNA
GitHub (maintainer security advisories)
Date Record Created
20201222	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20201222)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)