https://bugzilla.redhat.com/show_bug.cgi?id=1942642
Bug ID: 1942642 Summary: CVE-2021-21351 XStream: allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team@redhat.com Reporter: gsuckevi@redhat.com CC: abenaiss@redhat.com, aileenc@redhat.com, akoufoud@redhat.com, alazarot@redhat.com, almorale@redhat.com, anstephe@redhat.com, aos-bugs@redhat.com, ataylor@redhat.com, bibryam@redhat.com, bmontgom@redhat.com, chazlett@redhat.com, dchen@redhat.com, drieden@redhat.com, eparis@redhat.com, etirelli@redhat.com, ggaughan@redhat.com, gmalinko@redhat.com, gvarsami@redhat.com, hbraun@redhat.com, ibek@redhat.com, janstey@redhat.com, java-maint@redhat.com, java-sig-commits@lists.fedoraproject.org, jburrell@redhat.com, jcoleman@redhat.com, jochrist@redhat.com, jokerman@redhat.com, jolee@redhat.com, jross@redhat.com, jschatte@redhat.com, jstastny@redhat.com, jwon@redhat.com, kaycoth@redhat.com, kconner@redhat.com, krathod@redhat.com, kverlaen@redhat.com, ldimaggi@redhat.com, lkundrak@v3.sk, mizdebsk@redhat.com, mnovotny@redhat.com, nstielau@redhat.com, nwallace@redhat.com, pantinor@redhat.com, pbhattac@redhat.com, pjindal@redhat.com, rrajasek@redhat.com, rsynek@redhat.com, rwagner@redhat.com, sdaley@redhat.com, sponnaga@redhat.com, tcunning@redhat.com, tkirby@redhat.com, vbobade@redhat.com Target Milestone: --- Classification: Other
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.
References: https://github.com/x-stream/xstream/security/advisories/GHSA-hrcp-8f3q-4w2c https://x-stream.github.io/CVE-2021-21351.html
https://bugzilla.redhat.com/show_bug.cgi?id=1942642
Guilherme de Almeida Suckevicz gsuckevi@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1942643
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1942643 [Bug 1942643] CVE-2021-21351 xstream: allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1942642
--- Comment #1 from Guilherme de Almeida Suckevicz gsuckevi@redhat.com --- Created xstream tracking bugs for this issue:
Affects: fedora-all [bug 1942643]
https://bugzilla.redhat.com/show_bug.cgi?id=1942642
Guilherme de Almeida Suckevicz gsuckevi@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1942645
https://bugzilla.redhat.com/show_bug.cgi?id=1942642
Przemyslaw Roguski proguski@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Fixed In Version| |xstream 1.4.16
https://bugzilla.redhat.com/show_bug.cgi?id=1942642
--- Comment #2 from Przemyslaw Roguski proguski@redhat.com --- Statement:
OpenShift Container Platform (OCP) delivers Jenkins LTS package with bundled XStream library. Due to JEP-200 [1] and JEP-228 [2] Jenkins projects, OCP jenkins package is not affected by this flaw.
[1] https://github.com/jenkinsci/jep/blob/master/jep/200/README.adoc [2] https://github.com/jenkinsci/jep/blob/master/jep/228/README.adoc#security
https://bugzilla.redhat.com/show_bug.cgi?id=1942642
--- Comment #3 from amctagga@redhat.com --- Statement:
OpenShift Container Platform (OCP) delivers Jenkins LTS package with bundled XStream library. Due to JEP-200 [1] and JEP-228 [2] Jenkins projects, OCP Jenkins package is not affected by this flaw.
[1] https://github.com/jenkinsci/jep/blob/master/jep/200/README.adoc [2] https://github.com/jenkinsci/jep/blob/master/jep/228/README.adoc#security
https://bugzilla.redhat.com/show_bug.cgi?id=1942642
Kunjan Rathod krathod@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Flags| |needinfo?(chazlett@redhat.c | |om)
https://bugzilla.redhat.com/show_bug.cgi?id=1942642
Kunjan Rathod krathod@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Flags| |needinfo?(jwon@redhat.com)
https://bugzilla.redhat.com/show_bug.cgi?id=1942642
Kunjan Rathod krathod@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Flags| |needinfo?(pjindal@redhat.co | |m)
https://bugzilla.redhat.com/show_bug.cgi?id=1942642
Kunjan Rathod krathod@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Flags| |needinfo?(jochrist@redhat.c | |om)
https://bugzilla.redhat.com/show_bug.cgi?id=1942642
Ted (Jong Seok) Won jwon@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(jwon@redhat.com) |
https://bugzilla.redhat.com/show_bug.cgi?id=1942642
Chess Hazlett chazlett@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(chazlett@redhat.c | |om) |
https://bugzilla.redhat.com/show_bug.cgi?id=1942642
Paramvir jindal pjindal@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(pjindal@redhat.co | |m) |
https://bugzilla.redhat.com/show_bug.cgi?id=1942642
Jonathan Christison jochrist@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(jochrist@redhat.c | |om) |
https://bugzilla.redhat.com/show_bug.cgi?id=1942642
--- Comment #15 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat Data Grid 8.2.0
Via RHSA-2021:2139 https://access.redhat.com/errata/RHSA-2021:2139
https://bugzilla.redhat.com/show_bug.cgi?id=1942642
Product Security DevOps Team prodsec-dev@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Resolution|--- |ERRATA Last Closed| |2021-05-26 23:32:52
--- Comment #16 from Product Security DevOps Team prodsec-dev@redhat.com --- This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):
https://access.redhat.com/security/cve/cve-2021-21351
https://bugzilla.redhat.com/show_bug.cgi?id=1942642
--- Comment #17 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
RHPAM 7.11.0
Via RHSA-2021:2475 https://access.redhat.com/errata/RHSA-2021:2475
https://bugzilla.redhat.com/show_bug.cgi?id=1942642
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2021:2475
https://bugzilla.redhat.com/show_bug.cgi?id=1942642
--- Comment #18 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
RHDM 7.11.0
Via RHSA-2021:2476 https://access.redhat.com/errata/RHSA-2021:2476
https://bugzilla.redhat.com/show_bug.cgi?id=1942642
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2021:2476
https://bugzilla.redhat.com/show_bug.cgi?id=1942642 Bug 1942642 depends on bug 1942643, which changed state.
Bug 1942643 Summary: CVE-2021-21351 xstream: allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1942643
What |Removed |Added ---------------------------------------------------------------------------- Status|ON_QA |CLOSED Resolution|--- |ERRATA
https://bugzilla.redhat.com/show_bug.cgi?id=1942642
--- Comment #20 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat Integration
Via RHSA-2021:4767 https://access.redhat.com/errata/RHSA-2021:4767
https://bugzilla.redhat.com/show_bug.cgi?id=1942642
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2021:4767
https://bugzilla.redhat.com/show_bug.cgi?id=1942642
--- Comment #21 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat Integration
Via RHSA-2021:4918 https://access.redhat.com/errata/RHSA-2021:4918
https://bugzilla.redhat.com/show_bug.cgi?id=1942642
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2021:4918
https://bugzilla.redhat.com/show_bug.cgi?id=1942642
--- Comment #22 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat Fuse 7.10
Via RHSA-2021:5134 https://access.redhat.com/errata/RHSA-2021:5134
https://bugzilla.redhat.com/show_bug.cgi?id=1942642
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2021:5134
java-sig-commits@lists.fedoraproject.org