https://bugzilla.redhat.com/show_bug.cgi?id=1966735
Bug ID: 1966735
Summary: CVE-2021-29505 XStream: remote command execution
attack by manipulating the processed input stream
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: gsuckevi(a)redhat.com
CC: abenaiss(a)redhat.com, aileenc(a)redhat.com,
akoufoud(a)redhat.com, alazarot(a)redhat.com,
almorale(a)redhat.com, anstephe(a)redhat.com,
aos-bugs(a)redhat.com, ataylor(a)redhat.com,
bibryam(a)redhat.com, bmontgom(a)redhat.com,
chazlett(a)redhat.com, dchen(a)redhat.com,
drieden(a)redhat.com, eparis(a)redhat.com,
etirelli(a)redhat.com, ggaughan(a)redhat.com,
gmalinko(a)redhat.com, gvarsami(a)redhat.com,
hbraun(a)redhat.com, ibek(a)redhat.com,
janstey(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jburrell(a)redhat.com, jcoleman(a)redhat.com,
jochrist(a)redhat.com, jokerman(a)redhat.com,
jolee(a)redhat.com, jrokos(a)redhat.com, jross(a)redhat.com,
jschatte(a)redhat.com, jstastny(a)redhat.com,
jwon(a)redhat.com, kconner(a)redhat.com,
krathod(a)redhat.com, kverlaen(a)redhat.com,
ldimaggi(a)redhat.com, lkundrak(a)v3.sk,
mizdebsk(a)redhat.com, mnovotny(a)redhat.com,
nstielau(a)redhat.com, nwallace(a)redhat.com,
pantinor(a)redhat.com, pbhattac(a)redhat.com,
pjindal(a)redhat.com, rrajasek(a)redhat.com,
rwagner(a)redhat.com, sponnaga(a)redhat.com,
tcunning(a)redhat.com, tkirby(a)redhat.com,
tzimanyi(a)redhat.com, vbobade(a)redhat.com
Target Milestone: ---
Classification: Other
The vulnerability may allow a remote attacker has sufficient rights to execute
commands of the host only by manipulating the processed input stream. No user
is affected, who followed the recommendation to setup XStream's security
framework with a whitelist limited to the minimal required types.
Reference:
https://github.com/x-stream/xstream/security/advisories/GHSA-7chv-rrw6-w6fc
--
You are receiving this mail because:
You are on the CC list for the bug.