Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

fstec логотип

BDU:2022-00708

Опубликовано: 23 авг. 2021
Источник: fstec
CVSS3: 8.8
CVSS2: 6.5
EPSS Низкий

Описание

Уязвимость Java-библиотеки для преобразования объектов в XML или JSON формат XStream связана с недостатками механизма десериализации. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, выполнить произвольный код

Вендор

Red Hat Inc.
Сообщество свободного программного обеспечения
Novell Inc.
Fedora Project
Xstream Project

Наименование ПО

Red Hat Enterprise Linux
Debian GNU/Linux
Red Hat Descision Manager
OpenSUSE Leap
Data Grid
Red Hat Process Automation
Fedora
Red Hat Integration Camel Quarkus
Red Hat CodeReady Studio
XStream

Версия ПО

7 (Red Hat Enterprise Linux)
9 (Debian GNU/Linux)
10 (Debian GNU/Linux)
7 (Red Hat Descision Manager)
15.2 (OpenSUSE Leap)
8 (Data Grid)
7 (Red Hat Process Automation)
33 (Fedora)
34 (Fedora)
15.3 (OpenSUSE Leap)
- (Red Hat Integration Camel Quarkus)
11 (Debian GNU/Linux)
35 (Fedora)
12 (Red Hat CodeReady Studio)
до 1.4.18 (XStream)

Тип ПО

Операционная система
Прикладное ПО информационных систем

Операционные системы и аппаратные платформы

Red Hat Inc. Red Hat Enterprise Linux 7
Сообщество свободного программного обеспечения Debian GNU/Linux 9
Сообщество свободного программного обеспечения Debian GNU/Linux 10
Novell Inc. OpenSUSE Leap 15.2
Fedora Project Fedora 33
Fedora Project Fedora 34
Novell Inc. OpenSUSE Leap 15.3
Сообщество свободного программного обеспечения Debian GNU/Linux 11
Fedora Project Fedora 35

Уровень опасности уязвимости

Средний уровень опасности (базовая оценка CVSS 2.0 составляет 6,5)
Высокий уровень опасности (базовая оценка CVSS 3.0 составляет 8,8)

Возможные меры по устранению уязвимости

Использование рекомендаций:
https://x-stream.github.io/CVE-2021-39139.html
Для программных продуктов Novell Inc.:
https://www.suse.com/security/cve/CVE-2021-39139
Для программных продуктов Red Hat Inc.:
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-39139.xml
Для Fedora:
https://lists.fedoraproject.org/archives/search?mlist=package-announce%40lists.fedoraproject.org&q=CVE-2021-39139
Для Debian GNU/Linux:
https://security-tracker.debian.org/tracker/CVE-2021-39139

Статус уязвимости

Подтверждена производителем

Наличие эксплойта

Данные уточняются

Информация об устранении

Уязвимость устранена

Идентификаторы других систем описаний уязвимостей

EPSS

Процентиль: 70%
0.00673
Низкий

8.8 High

CVSS3

6.5 Medium

CVSS2

Связанные уязвимости

CVSS3: 8.5
ubuntu
около 4 лет назад

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. A user is only affected if using the version out of the box with JDK 1.7u21 or below. However, this scenario can be adjusted easily to an external Xalan that works regardless of the version of the Java runtime. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.

CVSS3: 8.5
redhat
около 4 лет назад

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. A user is only affected if using the version out of the box with JDK 1.7u21 or below. However, this scenario can be adjusted easily to an external Xalan that works regardless of the version of the Java runtime. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.

CVSS3: 8.5
nvd
около 4 лет назад

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. A user is only affected if using the version out of the box with JDK 1.7u21 or below. However, this scenario can be adjusted easily to an external Xalan that works regardless of the version of the Java runtime. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.

CVSS3: 8.5
debian
около 4 лет назад

XStream is a simple library to serialize objects to XML and back again ...

CVSS3: 8.5
github
около 4 лет назад

XStream is vulnerable to an Arbitrary Code Execution attack

EPSS

Процентиль: 70%
0.00673
Низкий

8.8 High

CVSS3

6.5 Medium

CVSS2