CVE Vulnerabilities

CVE-2021-39152

Deserialization of Untrusted Data

Published: Aug 23, 2021 | Modified: May 23, 2025
CVSS 3.x
8.5
HIGH
Source:
NVD
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS 2.x
6 MEDIUM
AV:N/AC:M/Au:S/C:P/I:P/A:P
RedHat/V2
RedHat/V3
8.5 IMPORTANT
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Ubuntu
MEDIUM

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream with a Java runtime version 14 to 8. No user is affected, who followed the recommendation to setup XStreams security framework with a whitelist limited to the minimal required types. If you rely on XStreams default blacklist of the Security Framework, you will have to use at least version 1.4.18.

Weakness

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Affected Software

Name Vendor Start Version End Version
Xstream Xstream * 1.4.18 (excluding)
Red Hat Data Grid 8.3.0 RedHat xstream *
Red Hat Enterprise Linux 7 RedHat xstream-0:1.3.1-16.el7_9 *
Red Hat Integration RedHat xstream *
Red Hat Integration Camel Quarkus 2 RedHat xstream *
RHDM 7.12.0 RedHat xstream *
RHPAM 7.12.0 RedHat xstream *
Libxstream-java Ubuntu bionic *
Libxstream-java Ubuntu esm-apps/bionic *
Libxstream-java Ubuntu esm-apps/focal *
Libxstream-java Ubuntu focal *
Libxstream-java Ubuntu hirsute *
Libxstream-java Ubuntu impish *
Libxstream-java Ubuntu trusty *
Libxstream-java Ubuntu xenial *

Potential Mitigations

  • Make fields transient to protect them from deserialization.
  • An attempt to serialize and then deserialize a class containing transient fields will result in NULLs where the transient data should be. This is an excellent way to prevent time, environment-based, or sensitive variables from being carried over and used improperly.

References