[Bug 1997772] New: CVE-2021-39144 xstream: vulnerable to a remote command execution attack

List overview All Threads
Download

newer

older

[Bug 2216887] New:...

[Bug 2170627] New: CVE-2022-41966...

bugzilla＠redhat.com

26 Aug 2021 26 Aug '21

12:32 a.m.

https://bugzilla.redhat.com/show_bug.cgi?id=1997772

Bug ID: 1997772 Summary: CVE-2021-39144 xstream: vulnerable to a remote command execution attack Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: high Priority: high Assignee: security-response-team@redhat.com Reporter: gsuckevi@redhat.com CC: abenaiss@redhat.com, aileenc@redhat.com, akoufoud@redhat.com, alazarot@redhat.com, almorale@redhat.com, anstephe@redhat.com, aos-bugs@redhat.com, ataylor@redhat.com, bibryam@redhat.com, bmontgom@redhat.com, chazlett@redhat.com, drieden@redhat.com, eparis@redhat.com, etirelli@redhat.com, extras-orphan@fedoraproject.org, fedoraproject.org@bluhm-de.com, ggaughan@redhat.com, gmalinko@redhat.com, gvarsami@redhat.com, hbraun@redhat.com, ibek@redhat.com, janstey@redhat.com, java-sig-commits@lists.fedoraproject.org, jburrell@redhat.com, jcoleman@redhat.com, jnethert@redhat.com, jochrist@redhat.com, jokerman@redhat.com, jolee@redhat.com, jrokos@redhat.com, jross@redhat.com, jschatte@redhat.com, jstastny@redhat.com, jwon@redhat.com, kconner@redhat.com, krathod@redhat.com, kverlaen@redhat.com, ldimaggi@redhat.com, lkundrak@v3.sk, mizdebsk@redhat.com, mnovotny@redhat.com, nstielau@redhat.com, nwallace@redhat.com, pantinor@redhat.com, pbhattac@redhat.com, pdelbell@redhat.com, pjindal@redhat.com, rrajasek@redhat.com, rwagner@redhat.com, sponnaga@redhat.com, tcunning@redhat.com, tkirby@redhat.com, tzimanyi@redhat.com Target Milestone: --- Classification: Other

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.

References: https://github.com/x-stream/xstream/security/advisories/GHSA-j9h8-phrw-h4fh https://x-stream.github.io/CVE-2021-39144.html

-- You are receiving this mail because: You are on the CC list for the bug.

Show replies by date

bugzilla＠redhat.com

26 Aug 26 Aug

12:33 a.m.

New subject: [Bug 1997772] CVE-2021-39144 xstream: vulnerable to a remote command execution attack

https://bugzilla.redhat.com/show_bug.cgi?id=1997772

Guilherme de Almeida Suckevicz gsuckevi@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1997773

Referenced Bugs:

https://bugzilla.redhat.com/show_bug.cgi?id=1997773 [Bug 1997773] CVE-2021-39144 xstream: vulnerable to a remote command execution attack [fedora-all]

-- You are receiving this mail because: You are on the CC list for the bug.

bugzilla＠redhat.com

12:33 a.m.

New subject: [Bug 1997772] CVE-2021-39144 xstream: vulnerable to a remote command execution attack

https://bugzilla.redhat.com/show_bug.cgi?id=1997772

--- Comment #1 from Guilherme de Almeida Suckevicz gsuckevi@redhat.com --- Created xstream tracking bugs for this issue:

Affects: fedora-all [bug 1997773]

-- You are receiving this mail because: You are on the CC list for the bug.

bugzilla＠redhat.com

1:38 a.m.

New subject: [Bug 1997772] CVE-2021-39144 xstream: vulnerable to a remote command execution attack

https://bugzilla.redhat.com/show_bug.cgi?id=1997772

Guilherme de Almeida Suckevicz gsuckevi@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1997804

-- You are receiving this mail because: You are on the CC list for the bug.

bugzilla＠redhat.com

1:49 p.m.

New subject: [Bug 1997772] CVE-2021-39144 xstream: vulnerable to a remote command execution attack

https://bugzilla.redhat.com/show_bug.cgi?id=1997772

Przemyslaw Roguski proguski@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Fixed In Version| |xstream 1.4.18

-- You are receiving this mail because: You are on the CC list for the bug.

bugzilla＠redhat.com

9:16 p.m.

New subject: [Bug 1997772] CVE-2021-39144 xstream: vulnerable to a remote command execution attack

https://bugzilla.redhat.com/show_bug.cgi?id=1997772

--- Doc Text *updated* by RaTasha Tillery-Smith rtillery@redhat.com --- A flaw was found in xstream, a simple library used to serialize objects to XML and back again. This flaw allows a remote attacker to load and execute arbitrary code from a remote host by manipulating the processed input stream. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

-- You are receiving this mail because: You are on the CC list for the bug.

bugzilla＠redhat.com

28 Aug 28 Aug

12:52 a.m.

New subject: [Bug 1997772] CVE-2021-39144 xstream: vulnerable to a remote command execution attack

https://bugzilla.redhat.com/show_bug.cgi?id=1997772

Garrett Tucker gtucker@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1998633

-- You are receiving this mail because: You are on the CC list for the bug.

bugzilla＠redhat.com

13 Oct 13 Oct

5:10 a.m.

New subject: [Bug 1997772] CVE-2021-39144 xstream: vulnerable to a remote command execution attack

https://bugzilla.redhat.com/show_bug.cgi?id=1997772 Bug 1997772 depends on bug 1997773, which changed state.

Bug 1997773 Summary: CVE-2021-39144 xstream: vulnerable to a remote command execution attack [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1997773

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=1997772

bugzilla＠redhat.com

25 Oct 25 Oct

12:20 p.m.

New subject: [Bug 1997772] CVE-2021-39144 xstream: Arbitrary code execution via unsafe deserialization of sun.tracing.*

https://bugzilla.redhat.com/show_bug.cgi?id=1997772

--- Comment #10 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:

Red Hat Enterprise Linux 7

Via RHSA-2021:3956 https://access.redhat.com/errata/RHSA-2021:3956

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=1997772

bugzilla＠redhat.com

12:20 p.m.

New subject: [Bug 1997772] CVE-2021-39144 xstream: Arbitrary code execution via unsafe deserialization of sun.tracing.*

https://bugzilla.redhat.com/show_bug.cgi?id=1997772

errata-xmlrpc errata-xmlrpc@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=1997772

bugzilla＠redhat.com

7:38 p.m.

New subject: [Bug 1997772] CVE-2021-39144 xstream: Arbitrary code execution via unsafe deserialization of sun.tracing.*

https://bugzilla.redhat.com/show_bug.cgi?id=1997772

Product Security DevOps Team prodsec-dev@redhat.com changed:

--- Comment #11 from Product Security DevOps Team prodsec-dev@redhat.com --- This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-39144

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=1997772

bugzilla＠redhat.com

23 Nov 23 Nov

4:06 p.m.

New subject: [Bug 1997772] CVE-2021-39144 xstream: Arbitrary code execution via unsafe deserialization of sun.tracing.*

https://bugzilla.redhat.com/show_bug.cgi?id=1997772

--- Comment #12 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:

Red Hat Integration

Via RHSA-2021:4767 https://access.redhat.com/errata/RHSA-2021:4767

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=1997772

bugzilla＠redhat.com

4:06 p.m.

New subject: [Bug 1997772] CVE-2021-39144 xstream: Arbitrary code execution via unsafe deserialization of sun.tracing.*

https://bugzilla.redhat.com/show_bug.cgi?id=1997772

errata-xmlrpc errata-xmlrpc@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=1997772

bugzilla＠redhat.com

2 Dec 2 Dec

9:48 p.m.

New subject: [Bug 1997772] CVE-2021-39144 xstream: Arbitrary code execution via unsafe deserialization of sun.tracing.*

https://bugzilla.redhat.com/show_bug.cgi?id=1997772

--- Comment #13 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:

Red Hat Integration

Via RHSA-2021:4918 https://access.redhat.com/errata/RHSA-2021:4918

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=1997772

bugzilla＠redhat.com

9:48 p.m.

New subject: [Bug 1997772] CVE-2021-39144 xstream: Arbitrary code execution via unsafe deserialization of sun.tracing.*

https://bugzilla.redhat.com/show_bug.cgi?id=1997772

errata-xmlrpc errata-xmlrpc@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=1997772

bugzilla＠redhat.com

26 Jan 26 Jan

9:23 p.m.

New subject: [Bug 1997772] CVE-2021-39144 xstream: Arbitrary code execution via unsafe deserialization of sun.tracing.*

https://bugzilla.redhat.com/show_bug.cgi?id=1997772

--- Comment #14 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:

RHPAM 7.12.0

Via RHSA-2022:0296 https://access.redhat.com/errata/RHSA-2022:0296

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=1997772

bugzilla＠redhat.com

9:23 p.m.

New subject: [Bug 1997772] CVE-2021-39144 xstream: Arbitrary code execution via unsafe deserialization of sun.tracing.*

https://bugzilla.redhat.com/show_bug.cgi?id=1997772

errata-xmlrpc errata-xmlrpc@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=1997772

bugzilla＠redhat.com

10:27 p.m.

New subject: [Bug 1997772] CVE-2021-39144 xstream: Arbitrary code execution via unsafe deserialization of sun.tracing.*

https://bugzilla.redhat.com/show_bug.cgi?id=1997772

--- Comment #15 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:

RHDM 7.12.0

Via RHSA-2022:0297 https://access.redhat.com/errata/RHSA-2022:0297

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=1997772

bugzilla＠redhat.com

10:27 p.m.

New subject: [Bug 1997772] CVE-2021-39144 xstream: Arbitrary code execution via unsafe deserialization of sun.tracing.*

https://bugzilla.redhat.com/show_bug.cgi?id=1997772

errata-xmlrpc errata-xmlrpc@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=1997772

bugzilla＠redhat.com

14 Feb 14 Feb

6:37 p.m.

New subject: [Bug 1997772] CVE-2021-39144 xstream: Arbitrary code execution via unsafe deserialization of sun.tracing.*

https://bugzilla.redhat.com/show_bug.cgi?id=1997772

--- Comment #16 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:

Red Hat Data Grid 8.3.0

Via RHSA-2022:0520 https://access.redhat.com/errata/RHSA-2022:0520

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=1997772

bugzilla＠redhat.com

6:37 p.m.

New subject: [Bug 1997772] CVE-2021-39144 xstream: Arbitrary code execution via unsafe deserialization of sun.tracing.*

https://bugzilla.redhat.com/show_bug.cgi?id=1997772

errata-xmlrpc errata-xmlrpc@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=1997772

bugzilla＠redhat.com

13 Mar 13 Mar

8:17 p.m.

New subject: [Bug 1997772] CVE-2021-39144 xstream: Arbitrary code execution via unsafe deserialization of sun.tracing.*

https://bugzilla.redhat.com/show_bug.cgi?id=1997772

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=1997772

bugzilla＠redhat.com

17 Mar 17 Mar

1:58 a.m.

New subject: [Bug 1997772] CVE-2021-39144 xstream: Arbitrary code execution via unsafe deserialization of sun.tracing.*

https://bugzilla.redhat.com/show_bug.cgi?id=1997772

Chess Hazlett chazlett@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=1997772

bugzilla＠redhat.com

10:11 p.m.

New subject: [Bug 1997772] CVE-2021-39144 xstream: Arbitrary code execution via unsafe deserialization of sun.tracing.*

https://bugzilla.redhat.com/show_bug.cgi?id=1997772

--- Comment #27 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:

Red Hat Data Grid 7.3.10

Via RHSA-2023:1303 https://access.redhat.com/errata/RHSA-2023:1303

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=1997772

bugzilla＠redhat.com

10:11 p.m.

New subject: [Bug 1997772] CVE-2021-39144 xstream: Arbitrary code execution via unsafe deserialization of sun.tracing.*

https://bugzilla.redhat.com/show_bug.cgi?id=1997772

errata-xmlrpc errata-xmlrpc@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=1997772

bugzilla＠redhat.com

18 Mar 18 Mar

12:07 a.m.

New subject: [Bug 1997772] CVE-2021-39144 xstream: Arbitrary code execution via unsafe deserialization of sun.tracing.*

https://bugzilla.redhat.com/show_bug.cgi?id=1997772

Chess Hazlett chazlett@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=1997772

bugzilla＠redhat.com

28 Jun 28 Jun

12:23 a.m.

New subject: [Bug 1997772] CVE-2021-39144 xstream: Arbitrary code execution via unsafe deserialization of sun.tracing.*

https://bugzilla.redhat.com/show_bug.cgi?id=1997772

--- Comment #29 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:

Red Hat Single Sign-On

Via RHSA-2023:3892 https://access.redhat.com/errata/RHSA-2023:3892

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=1997772 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report...

bugzilla＠redhat.com

12:23 a.m.

New subject: [Bug 1997772] CVE-2021-39144 xstream: Arbitrary code execution via unsafe deserialization of sun.tracing.*

https://bugzilla.redhat.com/show_bug.cgi?id=1997772

errata-xmlrpc errata-xmlrpc@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=1997772

576

Age (days ago)

1247

Last active (days ago)

java-sig-commits@lists.fedoraproject.org

27 comments

1 participants

tags (0)

participants (1)

bugzilla＠redhat.com