[Bug 1942642] New: CVE-2021-21351 XStream: allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream

https://bugzilla.redhat.com/show_bug.cgi?id=1942642

Bug ID: 1942642
           Summary: CVE-2021-21351 XStream: allow a remote attacker to
                    load and execute arbitrary code from a remote host
                    only by manipulating the processed input stream
           Product: Security Response
          Hardware: All
                OS: Linux
            Status: NEW
         Component: vulnerability
          Keywords: Security
          Severity: medium
          Priority: medium
          Assignee: [e-mail]
          Reporter: [e-mail]
                CC: [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail]
  Target Milestone: ---
    Classification: Other

XStream is a Java library to serialize objects to XML and back again. In
XStream before version 1.4.16, there is a vulnerability may allow a remote
attacker to load and execute arbitrary code from a remote host only by
manipulating the processed input stream. No user is affected, who followed the
recommendation to setup XStream's security framework with a whitelist limited
to the minimal required types. If you rely on XStream's default blacklist of
the Security Framework, you will have to use at least version 1.4.16.

References:
https://github.com/x-stream/xstream/security/advisories/GHSA-hrcp-8f3q-4w2c
https://x-stream.github.io/CVE-2021-21351.html

[Bug 1942642] CVE-2021-21351 XStream: allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream

https://bugzilla.redhat.com/show_bug.cgi?id=1942642

Guilherme de Almeida Suckevicz  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
         Depends On|                            |1942643

Referenced Bugs:

https://bugzilla.redhat.com/show_bug.cgi?id=1942643
[Bug 1942643] CVE-2021-21351 xstream: allow a remote attacker to load and
execute arbitrary code from a remote host only by manipulating the processed
input stream [fedora-all]

[Bug 1942642] CVE-2021-21351 XStream: allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream

https://bugzilla.redhat.com/show_bug.cgi?id=1942642

--- Comment #1 from Guilherme de Almeida Suckevicz  ---
Created xstream tracking bugs for this issue:

Affects: fedora-all [bug 1942643]

[Bug 1942642] CVE-2021-21351 XStream: allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream

https://bugzilla.redhat.com/show_bug.cgi?id=1942642

Guilherme de Almeida Suckevicz  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Blocks|                            |1942645

[Bug 1942642] CVE-2021-21351 XStream: allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream

https://bugzilla.redhat.com/show_bug.cgi?id=1942642

Przemyslaw Roguski  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
   Fixed In Version|                            |xstream 1.4.16

[Bug 1942642] CVE-2021-21351 XStream: allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream

https://bugzilla.redhat.com/show_bug.cgi?id=1942642

--- Comment #2 from Przemyslaw Roguski  ---
Statement:

OpenShift Container Platform (OCP) delivers Jenkins LTS package with bundled
XStream library. Due to JEP-200 [1] and JEP-228 [2] Jenkins projects, OCP
jenkins package is not affected by this flaw.

[1] https://github.com/jenkinsci/jep/blob/master/jep/200/README.adoc
[2] https://github.com/jenkinsci/jep/blob/master/jep/228/README.adoc#security

[Bug 1942642] CVE-2021-21351 XStream: allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream

https://bugzilla.redhat.com/show_bug.cgi?id=1942642

--- Comment #3 from [e-mail] ---
Statement:

OpenShift Container Platform (OCP) delivers Jenkins LTS package with bundled
XStream library. Due to JEP-200 [1] and JEP-228 [2] Jenkins projects, OCP
Jenkins package is not affected by this flaw.

[1] https://github.com/jenkinsci/jep/blob/master/jep/200/README.adoc
[2] https://github.com/jenkinsci/jep/blob/master/jep/228/README.adoc#security

[Bug 1942642] CVE-2021-21351 XStream: allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream

https://bugzilla.redhat.com/show_bug.cgi?id=1942642

Kunjan Rathod  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
              Flags|                            |needinfo?(chazlett@redhat.c
                   |                            |om)

[Bug 1942642] CVE-2021-21351 XStream: allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream

https://bugzilla.redhat.com/show_bug.cgi?id=1942642

Kunjan Rathod  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
              Flags|                            |needinfo?([e-mail])

[Bug 1942642] CVE-2021-21351 XStream: allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream

https://bugzilla.redhat.com/show_bug.cgi?id=1942642

Kunjan Rathod  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
              Flags|                            |needinfo?([e-mail]
                   |                            |m)

[Bug 1942642] CVE-2021-21351 XStream: allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream

https://bugzilla.redhat.com/show_bug.cgi?id=1942642

Kunjan Rathod  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
              Flags|                            |needinfo?(jochrist@redhat.c
                   |                            |om)

[Bug 1942642] CVE-2021-21351 XStream: allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream

https://bugzilla.redhat.com/show_bug.cgi?id=1942642

Ted (Jong Seok) Won  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
              Flags|needinfo?([e-mail])  |

[Bug 1942642] CVE-2021-21351 XStream: allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream

https://bugzilla.redhat.com/show_bug.cgi?id=1942642

Chess Hazlett  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
              Flags|needinfo?(chazlett@redhat.c |
                   |om)                         |

[Bug 1942642] CVE-2021-21351 XStream: allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream

https://bugzilla.redhat.com/show_bug.cgi?id=1942642

Paramvir jindal  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
              Flags|needinfo?([e-mail] |
                   |m)                          |

[Bug 1942642] CVE-2021-21351 XStream: allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream

https://bugzilla.redhat.com/show_bug.cgi?id=1942642

Jonathan Christison  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
              Flags|needinfo?(jochrist@redhat.c |
                   |om)                         |

[Bug 1942642] CVE-2021-21351 XStream: allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream

https://bugzilla.redhat.com/show_bug.cgi?id=1942642

--- Comment #15 from errata-xmlrpc  ---
This issue has been addressed in the following products:

Red Hat Data Grid 8.2.0

Via RHSA-2021:2139 https://access.redhat.com/errata/RHSA-2021:2139

[Bug 1942642] CVE-2021-21351 XStream: allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream

https://bugzilla.redhat.com/show_bug.cgi?id=1942642

Product Security DevOps Team  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |CLOSED
         Resolution|---                         |ERRATA
        Last Closed|                            |2021-05-26 23:32:52

--- Comment #16 from Product Security DevOps Team  ---
This bug is now closed. Further updates for individual products will be
reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-21351

[Bug 1942642] CVE-2021-21351 XStream: allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream

https://bugzilla.redhat.com/show_bug.cgi?id=1942642

--- Comment #17 from errata-xmlrpc  ---
This issue has been addressed in the following products:

RHPAM 7.11.0

Via RHSA-2021:2475 https://access.redhat.com/errata/RHSA-2021:2475

[Bug 1942642] CVE-2021-21351 XStream: allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream

https://bugzilla.redhat.com/show_bug.cgi?id=1942642

errata-xmlrpc  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
            Link ID|                            |Red Hat Product Errata
                   |                            |RHSA-2021:2475

[Bug 1942642] CVE-2021-21351 XStream: allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream

https://bugzilla.redhat.com/show_bug.cgi?id=1942642

--- Comment #18 from errata-xmlrpc  ---
This issue has been addressed in the following products:

RHDM 7.11.0

Via RHSA-2021:2476 https://access.redhat.com/errata/RHSA-2021:2476

[Bug 1942642] CVE-2021-21351 XStream: allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream

https://bugzilla.redhat.com/show_bug.cgi?id=1942642

errata-xmlrpc  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
            Link ID|                            |Red Hat Product Errata
                   |                            |RHSA-2021:2476

[Bug 1942642] CVE-2021-21351 XStream: allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream

https://bugzilla.redhat.com/show_bug.cgi?id=1942642
Bug 1942642 depends on bug 1942643, which changed state.

Bug 1942643 Summary: CVE-2021-21351 xstream: allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1942643

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ON_QA                       |CLOSED
         Resolution|---                         |ERRATA

[Bug 1942642] CVE-2021-21351 XStream: allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream

https://bugzilla.redhat.com/show_bug.cgi?id=1942642

--- Comment #20 from errata-xmlrpc  ---
This issue has been addressed in the following products:

Red Hat Integration

Via RHSA-2021:4767 https://access.redhat.com/errata/RHSA-2021:4767

[Bug 1942642] CVE-2021-21351 XStream: allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream

https://bugzilla.redhat.com/show_bug.cgi?id=1942642

errata-xmlrpc  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
            Link ID|                            |Red Hat Product Errata
                   |                            |RHSA-2021:4767

[Bug 1942642] CVE-2021-21351 XStream: allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream

https://bugzilla.redhat.com/show_bug.cgi?id=1942642

--- Comment #21 from errata-xmlrpc  ---
This issue has been addressed in the following products:

Red Hat Integration

Via RHSA-2021:4918 https://access.redhat.com/errata/RHSA-2021:4918

[Bug 1942642] CVE-2021-21351 XStream: allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream

https://bugzilla.redhat.com/show_bug.cgi?id=1942642

errata-xmlrpc  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
            Link ID|                            |Red Hat Product Errata
                   |                            |RHSA-2021:4918

[Bug 1942642] CVE-2021-21351 XStream: allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream

https://bugzilla.redhat.com/show_bug.cgi?id=1942642

--- Comment #22 from errata-xmlrpc  ---
This issue has been addressed in the following products:

Red Hat Fuse 7.10

Via RHSA-2021:5134 https://access.redhat.com/errata/RHSA-2021:5134

[Bug 1942642] CVE-2021-21351 XStream: allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream

https://bugzilla.redhat.com/show_bug.cgi?id=1942642

errata-xmlrpc  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
            Link ID|                            |Red Hat Product Errata
                   |                            |RHSA-2021:5134