CVE-2021-29505

Опубликовано: 14 мая 2021

Источник: redhat

CVSS3: 7.5

EPSS Критический

Описание

XStream is software for serializing Java objects to XML and back again. A vulnerability in XStream versions prior to 1.4.17 may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types is affected. The vulnerability is patched in version 1.4.17.

A flaw was found in XStream. By manipulating the processed input stream, a remote attacker may be able to obtain sufficient rights to execute commands. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Отчет

OpenShift Container Platform (OCP) delivers Jenkins LTS package with bundled XStream library. Due to JEP-200 [1] and JEP-228 [2] Jenkins projects, OCP Jenkins package is not affected by this flaw. CodeReady Studio 12 ships a version of xstream that is affected by this flaw as a transitive dependency for the Wise framework plugin. However, the vulnerable code is not called, so this flaw has been marked as Low severity for CodeReady Studio 12. [1] https://github.com/jenkinsci/jep/blob/master/jep/200/README.adoc [2] https://github.com/jenkinsci/jep/blob/master/jep/228/README.adoc#security

Меры по смягчению последствий

Depending on the version of XStream used there are various usage patterns that mitigate this flaw, though we would strongly recommend using the allow list approach if at all possible as there are likely more class combinations the deny list approach may not address. Allow list approach

XStream xstream = new XStream(); XStream.setupDefaultSecurity(xstream); xstream.allowTypesByWildcard(new String[] {"com.misc.classname"})

Deny list for XStream 1.4.16 (this should also address some previous flaws found in 1.4.7 - > 1.4.15)

xstream.denyTypesByRegExp(new String[]{ ".*\\.Lazy(?:Search)?Enumeration.*", "(?:java|sun)\\.rmi\\..*" });

Deny list for XStream 1.4.15

xstream.denyTypes(new String[]{ "sun.awt.datatransfer.DataTransferer$IndexOrderComparator", "sun.swing.SwingLazyValue", "com.sun.corba.se.impl.activation.ServerTableEntry", "com.sun.tools.javac.processing.JavacProcessingEnvironment$NameProcessIterator" }); xstream.denyTypesByRegExp(new String[]{ ".*\\$ServiceNameIterator", "javafx\\.collections\\.ObservableList\\$.*", ".*\\.bcel\\..*\\.util\\.ClassLoader" }); xstream.denyTypeHierarchy(java.io.InputStream.class ); xstream.denyTypeHierarchy(java.nio.channels.Channel.class ); xstream.denyTypeHierarchy(javax.activation.DataSource.class ); xstream.denyTypeHierarchy(javax.sql.rowset.BaseRowSet.class );

Deny list for XStream 1.4.13

xstream.denyTypes(new String[]{ "javax.imageio.ImageIO$ContainsFilter" }); xstream.denyTypes(new Class[]{ java.lang.ProcessBuilder.class });

Deny list for XStream 1.4.7 -> 1.4.12

xstream.denyTypes(new String[]{ "javax.imageio.ImageIO$ContainsFilter" }); xstream.denyTypes(new Class[]{ java.lang.ProcessBuilder.class, java.beans.EventHandler.class, java.lang.ProcessBuilder.class, java.lang.Void.class, void.class });

Deny list for versions prior to XStream 1.4.7

xstream.registerConverter(new Converter() { public boolean canConvert(Class type) { return type != null && (type == java.beans.EventHandler.class || type == java.lang.ProcessBuilder.class || type == java.lang.Void.class || void.class || type.getName().equals("javax.imageio.ImageIO$ContainsFilter") || Proxy.isProxy(type)); } public Object unmarshal(HierarchicalStreamReader reader, UnmarshallingContext context) { throw new ConversionException("Unsupported type due to security reasons."); } public void marshal(Object source, HierarchicalStreamWriter writer, MarshallingContext context) { throw new ConversionException("Unsupported type due to security reasons."); } }, XStream.PRIORITY_LOW);

Затронутые пакеты

Платформа	Пакет	Состояние
Red Hat BPM Suite 6	xstream	Will not fix
Red Hat CodeReady Studio 12	xstream	Affected
Red Hat JBoss A-MQ 6	xstream	Out of support scope
Red Hat JBoss BRMS 5	xstream	Will not fix
Red Hat JBoss BRMS 6	xstream	Will not fix
Red Hat JBoss Data Grid 7	xstream	Out of support scope
Red Hat JBoss Data Virtualization 6	xstream	Will not fix
Red Hat JBoss Fuse 6	xstream	Out of support scope
Red Hat JBoss Fuse Service Works 6	xstream	Out of support scope
Red Hat JBoss SOA Platform 5	xstream	Will not fix

Показывать по

Ссылки на источники

Дополнительная информация

Статус:

Important

Дефект:

CWE-94->CWE-502

https://bugzilla.redhat.com/show_bug.cgi?id=1966735XStream: remote command execution attack by manipulating the processed input stream

EPSS

Процентиль: 100%

0.90769

Критический

7.5 High

CVSS3

Связанные уязвимости

CVE-2021-29505

CVSS3: 7.5

ubuntu

больше 4 лет назад

CVE-2021-29505

CVSS3: 7.5

nvd

больше 4 лет назад

CVE-2021-29505

CVSS3: 7.5

debian

больше 4 лет назад

XStream is software for serializing Java objects to XML and back again ...

openSUSE-SU-2021:1995-1

suse-cvrf

больше 4 лет назад

Security update for xstream

openSUSE-SU-2021:0911-1

suse-cvrf

больше 4 лет назад

Security update for xstream

EPSS

Процентиль: 100%

0.90769

Критический

7.5 High

CVSS3