CVE-2021-21348

Опубликовано: 23 мар. 2021

Источник: nvd

CVSS3: 5.3

CVSS3: 7.5

CVSS2: 7.8

EPSS Низкий

Уязвимость захвата потока, потребляющего максимальное процессорное время в XStream до версии 1.4.16

Описание

XStream — это Java-библиотека для сериализации объектов в XML и обратно. В XStream до версии 1.4.16 существует уязвимость, позволяющая злоумышленнику занять поток, который потребляет максимальное время работы процессора и никогда не возвращается. Пользователь не затронут, если следовал рекомендации по настройке системы безопасности XStream, используя список разрешённых типов, ограниченный до минимальных необходимых.

Затронутые версии ПО

XStream до версии 1.4.16

Тип уязвимости

Захват потока

Ссылки

http://x-stream.github.io/changes.html#1.4.16
Release Notes
Third Party Advisory
https://github.com/x-stream/xstream/security/advisories/GHSA-56p8-3fh9-4cvq
Third Party Advisory
https://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae655414d23ed0dd%40%3Cusers.activemq.apache.org%3E
Third Party Advisory
Issue Tracking
Mailing List
https://lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fac48b425c6e16b0%40%3Cdev.jmeter.apache.org%3E
Third Party Advisory
Issue Tracking
Mailing List
https://lists.debian.org/debian-lts-announce/2021/04/msg00002.html
Mailing List
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/
Third Party Advisory
Mailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/
Third Party Advisory
Mailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/
Third Party Advisory
Mailing List
https://security.netapp.com/advisory/ntap-20210430-0002/
Third Party Advisory
https://www.debian.org/security/2021/dsa-5004
Third Party Advisory
Mailing List
https://www.oracle.com//security-alerts/cpujul2021.html
Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2022.html
Patch
Vendor Advisory
https://www.oracle.com/security-alerts/cpuoct2021.html
Third Party Advisory
https://x-stream.github.io/CVE-2021-21348.html
Third Party Advisory
https://x-stream.github.io/security.html#workaround
Mitigation
Third Party Advisory
http://x-stream.github.io/changes.html#1.4.16
Release Notes
Third Party Advisory
https://github.com/x-stream/xstream/security/advisories/GHSA-56p8-3fh9-4cvq
Third Party Advisory
https://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae655414d23ed0dd%40%3Cusers.activemq.apache.org%3E
Third Party Advisory
Issue Tracking
Mailing List
https://lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fac48b425c6e16b0%40%3Cdev.jmeter.apache.org%3E
Third Party Advisory
Issue Tracking
Mailing List
https://lists.debian.org/debian-lts-announce/2021/04/msg00002.html
Mailing List
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*

Конфигурация 2

Одно из

cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*

Версия до 5.15.14 (исключая)

cpe:2.3:a:apache:activemq:5.16.0:*:*:*:*:*:*:*

cpe:2.3:a:apache:activemq:5.16.1:*:*:*:*:*:*:*

cpe:2.3:a:apache:jmeter:*:*:*:*:*:*:*:*

Версия до 5.5 (исключая)

Конфигурация 3

cpe:2.3:a:xstream:xstream:*:*:*:*:*:*:*:*

Версия до 1.4.16 (исключая)

Конфигурация 4

Одно из

cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*

Конфигурация 5

Одно из

cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*

Конфигурация 6

Одно из

cpe:2.3:a:oracle:banking_enterprise_default_management:2.10.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:banking_enterprise_default_management:2.12.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:banking_platform:2.4.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:banking_platform:2.7.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:banking_platform:2.9.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:banking_platform:2.12.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:banking_virtual_account_management:14.2.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:banking_virtual_account_management:14.3.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:banking_virtual_account_management:14.5.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:business_activity_monitoring:11.1.1.9.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:business_activity_monitoring:12.2.1.3.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:business_activity_monitoring:12.2.1.4.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:communications_billing_and_revenue_management_elastic_charging_engine:12.0.0.3.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:communications_policy_management:12.5.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.2:*:*:*:*:*:*:*

cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.4:*:*:*:*:*:*:*

cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.5:*:*:*:*:*:*:*

cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*

Версия до 8.0.27 (включая)

cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0.6:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0.4:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_xstore_point_of_service:18.0.3:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_xstore_point_of_service:19.0.2:*:*:*:*:*:*:*

cpe:2.3:a:oracle:webcenter_portal:11.1.1.9.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0:*:*:*:*:*:*:*

EPSS

Процентиль: 46%

0.00232

Низкий

5.3 Medium

CVSS3

7.5 High

CVSS3

7.8 High

CVSS2

Дефекты

CWE-400

Связанные уязвимости

CVE-2021-21348

CVSS3: 5.3

ubuntu

около 4 лет назад

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to occupy a thread that consumes maximum CPU time and will never return. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.

CVE-2021-21348

CVSS3: 5.9

redhat

больше 4 лет назад

CVE-2021-21348

CVSS3: 5.3

debian

около 4 лет назад

XStream is a Java library to serialize objects to XML and back again. ...

GHSA-56p8-3fh9-4cvq

CVSS3: 5.3

github

около 4 лет назад

XStream is vulnerable to an attack using Regular Expression for a Denial of Service (ReDos)

BDU:2021-05485

CVSS3: 7.5

fstec

больше 4 лет назад

Уязвимость Java-библиотеки Xstream для преобразования объектов в форматы XML или JSON, связанная с неконтролируемым расходом ресурсов, позволяющая нарушителю вызвать отказ в обслуживании

EPSS

Процентиль: 46%

0.00232

Низкий

5.3 Medium

CVSS3

7.5 High

CVSS3

7.8 High

CVSS2

Дефекты

CWE-400