[Bug 1942642] New: CVE-2021-21351 XStream: allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream - java-sig-commits - Fedora Mailing-Lists

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

December

[Bug 1942642] New: CVE-2021-21351 XStream: allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream

[Bug 1948001] CVE-2021-3536...

[Bug 1942637] New: CVE-2021-21350...

bugzilla＠redhat.com

Wednesday, 24 March 2021 Wed, 24 Mar '21

11:22 a.m.

https://bugzilla.redhat.com/show_bug.cgi?id=1942642 Bug ID: 1942642 Summary: CVE-2021-21351 XStream: allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: gsuckevi(a)redhat.com CC: abenaiss(a)redhat.com, aileenc(a)redhat.com, akoufoud(a)redhat.com, alazarot(a)redhat.com, almorale(a)redhat.com, anstephe(a)redhat.com, aos-bugs(a)redhat.com, ataylor(a)redhat.com, bibryam(a)redhat.com, bmontgom(a)redhat.com, chazlett(a)redhat.com, dchen(a)redhat.com, drieden(a)redhat.com, eparis(a)redhat.com, etirelli(a)redhat.com, ggaughan(a)redhat.com, gmalinko(a)redhat.com, gvarsami(a)redhat.com, hbraun(a)redhat.com, ibek(a)redhat.com, janstey(a)redhat.com, java-maint(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jburrell(a)redhat.com, jcoleman(a)redhat.com, jochrist(a)redhat.com, jokerman(a)redhat.com, jolee(a)redhat.com, jross(a)redhat.com, jschatte(a)redhat.com, jstastny(a)redhat.com, jwon(a)redhat.com, kaycoth(a)redhat.com, kconner(a)redhat.com, krathod(a)redhat.com, kverlaen(a)redhat.com, ldimaggi(a)redhat.com, lkundrak(a)v3.sk, mizdebsk(a)redhat.com, mnovotny(a)redhat.com, nstielau(a)redhat.com, nwallace(a)redhat.com, pantinor(a)redhat.com, pbhattac(a)redhat.com, pjindal(a)redhat.com, rrajasek(a)redhat.com, rsynek(a)redhat.com, rwagner(a)redhat.com, sdaley(a)redhat.com, sponnaga(a)redhat.com, tcunning(a)redhat.com, tkirby(a)redhat.com, vbobade(a)redhat.com Target Milestone: --- Classification: Other XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16. References: https://github.com/x-stream/xstream/security/advisories/GHSA-hrcp-8f3q-4w2c https://x-stream.github.io/CVE-2021-21351.html -- You are receiving this mail because: You are on the CC list for the bug.

Reply

Show replies by date

bugzilla＠redhat.com

Wednesday, 24 March Wed, 24 Mar

11:22 a.m.

New subject: [Bug 1942642] CVE-2021-21351 XStream: allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream

https://bugzilla.redhat.com/show_bug.cgi?id=1942642 Guilherme de Almeida Suckevicz <gsuckevi(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1942643 Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=1942643 [Bug 1942643] CVE-2021-21351 xstream: allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream [fedora-all] -- You are receiving this mail because: You are on the CC list for the bug.

Reply

bugzilla＠redhat.com

11:22 a.m.

New subject: [Bug 1942642] CVE-2021-21351 XStream: allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream

https://bugzilla.redhat.com/show_bug.cgi?id=1942642 --- Comment #1 from Guilherme de Almeida Suckevicz <gsuckevi(a)redhat.com> --- Created xstream tracking bugs for this issue: Affects: fedora-all [bug 1942643] -- You are receiving this mail because: You are on the CC list for the bug.

Reply

bugzilla＠redhat.com

11:26 a.m.

New subject: [Bug 1942642] CVE-2021-21351 XStream: allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream

https://bugzilla.redhat.com/show_bug.cgi?id=1942642 Guilherme de Almeida Suckevicz <gsuckevi(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1942645 -- You are receiving this mail because: You are on the CC list for the bug.

Reply

bugzilla＠redhat.com

Monday, 29 March Mon, 29 Mar

5:15 a.m.

New subject: [Bug 1942642] CVE-2021-21351 XStream: allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream

https://bugzilla.redhat.com/show_bug.cgi?id=1942642 Przemyslaw Roguski <proguski(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Fixed In Version| |xstream 1.4.16 -- You are receiving this mail because: You are on the CC list for the bug.

Reply

bugzilla＠redhat.com

5:39 a.m.

New subject: [Bug 1942642] CVE-2021-21351 XStream: allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream

https://bugzilla.redhat.com/show_bug.cgi?id=1942642 --- Comment #2 from Przemyslaw Roguski <proguski(a)redhat.com> --- Statement: OpenShift Container Platform (OCP) delivers Jenkins LTS package with bundled XStream library. Due to JEP-200 [1] and JEP-228 [2] Jenkins projects, OCP jenkins package is not affected by this flaw. [1] https://github.com/jenkinsci/jep/blob/master/jep/200/README.adoc [2] https://github.com/jenkinsci/jep/blob/master/jep/228/README.adoc#security -- You are receiving this mail because: You are on the CC list for the bug.

Reply

bugzilla＠redhat.com

10:09 a.m.

New subject: [Bug 1942642] CVE-2021-21351 XStream: allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream

https://bugzilla.redhat.com/show_bug.cgi?id=1942642 --- Comment #3 from amctagga(a)redhat.com --- Statement: OpenShift Container Platform (OCP) delivers Jenkins LTS package with bundled XStream library. Due to JEP-200 [1] and JEP-228 [2] Jenkins projects, OCP Jenkins package is not affected by this flaw. [1] https://github.com/jenkinsci/jep/blob/master/jep/200/README.adoc [2] https://github.com/jenkinsci/jep/blob/master/jep/228/README.adoc#security -- You are receiving this mail because: You are on the CC list for the bug.

Reply

bugzilla＠redhat.com

Tuesday, 30 March Tue, 30 Mar

7:49 p.m.

New subject: [Bug 1942642] CVE-2021-21351 XStream: allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream

https://bugzilla.redhat.com/show_bug.cgi?id=1942642 Kunjan Rathod <krathod(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags| |needinfo?(chazlett(a)redhat.c | |om) -- You are receiving this mail because: You are on the CC list for the bug.

Reply

bugzilla＠redhat.com

7:49 p.m.

New subject: [Bug 1942642] CVE-2021-21351 XStream: allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream

https://bugzilla.redhat.com/show_bug.cgi?id=1942642 Kunjan Rathod <krathod(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags| |needinfo?(jwon(a)redhat.com) -- You are receiving this mail because: You are on the CC list for the bug.

Reply

bugzilla＠redhat.com

7:50 p.m.

New subject: [Bug 1942642] CVE-2021-21351 XStream: allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream

https://bugzilla.redhat.com/show_bug.cgi?id=1942642 Kunjan Rathod <krathod(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags| |needinfo?(pjindal(a)redhat.co | |m) -- You are receiving this mail because: You are on the CC list for the bug.

Reply

bugzilla＠redhat.com

7:50 p.m.

New subject: [Bug 1942642] CVE-2021-21351 XStream: allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream

https://bugzilla.redhat.com/show_bug.cgi?id=1942642 Kunjan Rathod <krathod(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags| |needinfo?(jochrist(a)redhat.c | |om) -- You are receiving this mail because: You are on the CC list for the bug.

Reply

bugzilla＠redhat.com

Wednesday, 31 March Wed, 31 Mar

12:34 a.m.

New subject: [Bug 1942642] CVE-2021-21351 XStream: allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream

https://bugzilla.redhat.com/show_bug.cgi?id=1942642 Ted (Jong Seok) Won <jwon(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(jwon(a)redhat.com) | -- You are receiving this mail because: You are on the CC list for the bug.

Reply

bugzilla＠redhat.com

2:06 p.m.

New subject: [Bug 1942642] CVE-2021-21351 XStream: allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream

https://bugzilla.redhat.com/show_bug.cgi?id=1942642 Chess Hazlett <chazlett(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(chazlett(a)redhat.c | |om) | -- You are receiving this mail because: You are on the CC list for the bug.

Reply

bugzilla＠redhat.com

Thursday, 1 April Thu, 1 Apr

7:42 a.m.

New subject: [Bug 1942642] CVE-2021-21351 XStream: allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream

https://bugzilla.redhat.com/show_bug.cgi?id=1942642 Paramvir jindal <pjindal(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(pjindal(a)redhat.co | |m) | -- You are receiving this mail because: You are on the CC list for the bug.

Reply

bugzilla＠redhat.com

Wednesday, 7 April Wed, 7 Apr

10:42 a.m.

New subject: [Bug 1942642] CVE-2021-21351 XStream: allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream

https://bugzilla.redhat.com/show_bug.cgi?id=1942642 Jonathan Christison <jochrist(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(jochrist(a)redhat.c | |om) | -- You are receiving this mail because: You are on the CC list for the bug.

Reply

bugzilla＠redhat.com

Wednesday, 26 May Wed, 26 May

4:50 p.m.

New subject: [Bug 1942642] CVE-2021-21351 XStream: allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream

https://bugzilla.redhat.com/show_bug.cgi?id=1942642 --- Comment #15 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> --- This issue has been addressed in the following products: Red Hat Data Grid 8.2.0 Via RHSA-2021:2139 https://access.redhat.com/errata/RHSA-2021:2139 -- You are receiving this mail because: You are on the CC list for the bug.

Reply

bugzilla＠redhat.com

6:32 p.m.

New subject: [Bug 1942642] CVE-2021-21351 XStream: allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream

https://bugzilla.redhat.com/show_bug.cgi?id=1942642 Product Security DevOps Team <prodsec-dev(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Resolution|--- |ERRATA Last Closed| |2021-05-26 23:32:52 --- Comment #16 from Product Security DevOps Team <prodsec-dev(a)redhat.com> --- This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2021-21351 -- You are receiving this mail because: You are on the CC list for the bug.

Reply

bugzilla＠redhat.com

Thursday, 17 June Thu, 17 Jun

8:16 a.m.

New subject: [Bug 1942642] CVE-2021-21351 XStream: allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream

https://bugzilla.redhat.com/show_bug.cgi?id=1942642 --- Comment #17 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> --- This issue has been addressed in the following products: RHPAM 7.11.0 Via RHSA-2021:2475 https://access.redhat.com/errata/RHSA-2021:2475 -- You are receiving this mail because: You are on the CC list for the bug.

Reply

bugzilla＠redhat.com

8:17 a.m.

New subject: [Bug 1942642] CVE-2021-21351 XStream: allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream

https://bugzilla.redhat.com/show_bug.cgi?id=1942642 errata-xmlrpc <errata-xmlrpc(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2021:2475 -- You are receiving this mail because: You are on the CC list for the bug.

Reply

bugzilla＠redhat.com

8:20 a.m.

New subject: [Bug 1942642] CVE-2021-21351 XStream: allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream

https://bugzilla.redhat.com/show_bug.cgi?id=1942642 --- Comment #18 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> --- This issue has been addressed in the following products: RHDM 7.11.0 Via RHSA-2021:2476 https://access.redhat.com/errata/RHSA-2021:2476 -- You are receiving this mail because: You are on the CC list for the bug.

Reply

bugzilla＠redhat.com

8:21 a.m.

New subject: [Bug 1942642] CVE-2021-21351 XStream: allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream

https://bugzilla.redhat.com/show_bug.cgi?id=1942642 errata-xmlrpc <errata-xmlrpc(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2021:2476 -- You are receiving this mail because: You are on the CC list for the bug.

Reply

bugzilla＠redhat.com

Tuesday, 12 October Tue, 12 Oct

6:39 p.m.

New subject: [Bug 1942642] CVE-2021-21351 XStream: allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream

https://bugzilla.redhat.com/show_bug.cgi?id=1942642 Bug 1942642 depends on bug 1942643, which changed state. Bug 1942643 Summary: CVE-2021-21351 xstream: allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1942643 What |Removed |Added ---------------------------------------------------------------------------- Status|ON_QA |CLOSED Resolution|--- |ERRATA -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=1942642

Reply

bugzilla＠redhat.com

Tuesday, 23 November Tue, 23 Nov

4:35 a.m.

New subject: [Bug 1942642] CVE-2021-21351 XStream: allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream

https://bugzilla.redhat.com/show_bug.cgi?id=1942642 --- Comment #20 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> --- This issue has been addressed in the following products: Red Hat Integration Via RHSA-2021:4767 https://access.redhat.com/errata/RHSA-2021:4767 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=1942642

Reply

bugzilla＠redhat.com

4:35 a.m.

New subject: [Bug 1942642] CVE-2021-21351 XStream: allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream

https://bugzilla.redhat.com/show_bug.cgi?id=1942642 errata-xmlrpc <errata-xmlrpc(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2021:4767 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=1942642

Reply

bugzilla＠redhat.com

Thursday, 2 December Thu, 2 Dec

10:18 a.m.

New subject: [Bug 1942642] CVE-2021-21351 XStream: allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream

https://bugzilla.redhat.com/show_bug.cgi?id=1942642 --- Comment #21 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> --- This issue has been addressed in the following products: Red Hat Integration Via RHSA-2021:4918 https://access.redhat.com/errata/RHSA-2021:4918 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=1942642

Reply

bugzilla＠redhat.com

10:18 a.m.

New subject: [Bug 1942642] CVE-2021-21351 XStream: allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream

https://bugzilla.redhat.com/show_bug.cgi?id=1942642 errata-xmlrpc <errata-xmlrpc(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2021:4918 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=1942642

Reply

bugzilla＠redhat.com

Tuesday, 14 December Tue, 14 Dec

3:34 p.m.

New subject: [Bug 1942642] CVE-2021-21351 XStream: allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream

https://bugzilla.redhat.com/show_bug.cgi?id=1942642 --- Comment #22 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> --- This issue has been addressed in the following products: Red Hat Fuse 7.10 Via RHSA-2021:5134 https://access.redhat.com/errata/RHSA-2021:5134 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=1942642

Reply

bugzilla＠redhat.com

3:34 p.m.

New subject: [Bug 1942642] CVE-2021-21351 XStream: allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream

https://bugzilla.redhat.com/show_bug.cgi?id=1942642 errata-xmlrpc <errata-xmlrpc(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2021:5134 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=1942642

Reply

925

days inactive

1190

days old

java-sig-commits@lists.fedoraproject.org

Manage subscription

27 comments

1 participants

tags (0)

participants (1)

bugzilla＠redhat.com