Lucene search

[email protected]CVE-2021-21341

HistoryMar 23, 2021 - 12:15 a.m.

CVE-2021-21341

2021-03-2300:15:12

CWE-502

CWE-400

[email protected]

web.nvd.nist.gov

322

xstream

java

library

serialization

xml

vulnerability

cpu dos

nvd

7.1 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:N/I:N/A:C

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

8.3 High

AI Score

Confidence

High

0.011 Low

EPSS

Percentile

84.3%

JSON

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is vulnerability which may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a payload resulting in a denial of service only by manipulating the processed input stream. No user is affected who followed the recommendation to setup XStream’s security framework with a whitelist limited to the minimal required types. If you rely on XStream’s default blacklist of the Security Framework, you will have to use at least version 1.4.16.

Affected configurations

Vulners

NVD

Node

x-streamxstreamRange<1.4.16

CPENameOperatorVersion
xstream_project:xstreamxstream project xstreamlt1.4.16

CPE	Name	Operator	Version
xstream_project:xstream	xstream project xstream	lt	1.4.16

CNA Affected

[
  {
    "product": "xstream",
    "vendor": "x-stream",
    "versions": [
      {
        "status": "affected",
        "version": "< 1.4.16"
      }
    ]
  }
]