crítica
CVE-2021-21342
XStream: SSRF via crafted input stream
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
GHSA5.3CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
Red Hat7.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Bitnami9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD, Bitnami. Más baja según Amazon (alta), GHSA (media), Red Hat (media), Ubuntu (media).
Descripción
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability where the processed stream at unmarshalling time contains type information to recreate the formerly written objects. XStream creates therefore new instances based on these type information. An attacker can manipulate the processed input stream and replace or inject objects, that result in a server-side forgery request. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | activemq | 5.15.14 |
| amazon linux 2 | xstream, xstream-javadoc | 1.3.1-16.amzn2.0.2 |
| debian 10 | libxstream-java | 1.4.11.1-1+deb10u3 |
| debian 11 | libxstream-java | 1.4.15-2 |
| debian 12 | libxstream-java | 1.4.15-2 |
| debian 13 | libxstream-java | 1.4.15-2 |
| debian 14 | libxstream-java | 1.4.15-2 |
| debian 9 | libxstream-java | 1.4.11.1-1+deb9u2 |
| echo | libxstream-java | 1.4.15-2 |
| maven::GitHub Security Advisory Maven | com.thoughtworks.xstream:xstream | 1.4.16 |
| Red Hat | xstream, xstream-javadoc | sin corrección indicada |
| ubuntu 14.04-ESM | libxstream-java | 1.4.7-1ubuntu0.1+esm2 |
Mostrar las 28 entradas de 26 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | activemq | 5.15.14 |
| amazon linux 2 | xstream | 1.3.1-16.amzn2.0.2 |
| amazon linux 2 | xstream-javadoc | 1.3.1-16.amzn2.0.2 |
| debian 10 | libxstream-java | 1.4.11.1-1+deb10u3 |
| debian 11 | libxstream-java | 1.4.15-2 |
| debian 12 | libxstream-java | 1.4.15-2 |
| debian 13 | libxstream-java | 1.4.15-2 |
| debian 14 | libxstream-java | 1.4.15-2 |
| debian 9 | libxstream-java | 1.4.11.1-1+deb9u2 |
| echo | libxstream-java | 1.4.15-2 |
| maven::GitHub Security Advisory Maven | com.thoughtworks.xstream:xstream | 1.4.16 |
| Red Hat | xstream | sin corrección indicada |
| Red Hat | xstream-javadoc | sin corrección indicada |
| ubuntu 14.04-ESM | libxstream-java | 1.4.7-1ubuntu0.1+esm2 |
| ubuntu 16.04-ESM | libxstream-java | 1.4.8-1ubuntu0.1+esm3 |
| ubuntu 18.04 | libxstream-java | 1.4.11.1-1~18.04.2 |
| ubuntu 18.04-ESM | libxstream-java | 1.4.11.1-1~18.04.2 |
| ubuntu 20.04 | libxstream-java | 1.4.11.1-1ubuntu0.2 |
| ubuntu 20.04-ESM | libxstream-java | 1.4.11.1-1ubuntu0.2 |
| ubuntu 20.10 | libxstream-java | 1.4.11.1-2ubuntu0.1 |
| ubuntu 21.04 | libxstream-java | 1.4.15-1ubuntu0.1 |
| ubuntu 21.10 | libxstream-java | 1.4.15-2 |
| ubuntu 22.04 | libxstream-java | 1.4.15-2 |
| ubuntu 22.10 | libxstream-java | 1.4.15-2 |
| ubuntu 23.04 | libxstream-java | 1.4.15-2 |
| ubuntu 23.10 | libxstream-java | 1.4.15-2 |
| ubuntu 24.04 | libxstream-java | 1.4.15-2 |
| ubuntu 24.10 | libxstream-java | 1.4.15-2 |
Referencias
- http://x-stream.github.io/changes.html#1.4.16
- https://access.redhat.com/security/cve/CVE-2021-21342
- https://github.com/x-stream/xstream
- https://github.com/x-stream/xstream/security/advisories/GHSA-hvv8-336g-rx3m
- https://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae655414d23ed0dd@%3Cusers.activemq.apache.org%3E
- https://lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fac48b425c6e16b0@%3Cdev.jmeter.apache.org%3E
- https://lists.debian.org/debian-lts-announce/2021/04/msg00002.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP
Las 25 referencias
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/
- https://nvd.nist.gov/vuln/detail/CVE-2021-21342
- https://security.netapp.com/advisory/ntap-20210430-0002
- https://security.netapp.com/advisory/ntap-20210430-0002/
- https://ubuntu.com/security/notices/USN-4943-1
- https://ubuntu.com/security/notices/USN-6978-1
- https://www.cve.org/CVERecord?id=CVE-2021-21342
- https://www.debian.org/security/2021/dsa-5004
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://x-stream.github.io/CVE-2021-21342.html
- https://x-stream.github.io/security.html#workaround