[Bug 1942629] New: CVE-2021-21347 XStream: allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream

https://bugzilla.redhat.com/show_bug.cgi?id=1942629

Bug ID: 1942629
           Summary: CVE-2021-21347 XStream: allow a remote attacker to
                    load and execute arbitrary code from a remote host
                    only by manipulating the processed input stream
           Product: Security Response
          Hardware: All
                OS: Linux
            Status: NEW
         Component: vulnerability
          Keywords: Security
          Severity: medium
          Priority: medium
          Assignee: [e-mail]
          Reporter: [e-mail]
                CC: [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail]
  Target Milestone: ---
    Classification: Other

XStream is a Java library to serialize objects to XML and back again. In
XStream before version 1.4.16, there is a vulnerability which may allow a
remote attacker to load and execute arbitrary code from a remote host only by
manipulating the processed input stream. No user is affected, who followed the
recommendation to setup XStream's security framework with a whitelist limited
to the minimal required types. If you rely on XStream's default blacklist of
the Security Framework, you will have to use at least version 1.4.16.

References:
https://github.com/x-stream/xstream/security/advisories/GHSA-qpfq-ph7r-qv6f
https://x-stream.github.io/CVE-2021-21347.html

[Bug 1942629] CVE-2021-21347 XStream: allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream

https://bugzilla.redhat.com/show_bug.cgi?id=1942629

Guilherme de Almeida Suckevicz  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
         Depends On|                            |1942631

Referenced Bugs:

https://bugzilla.redhat.com/show_bug.cgi?id=1942631
[Bug 1942631] CVE-2021-21347 xstream: allow a remote attacker to load and
execute arbitrary code from a remote host only by manipulating the processed
input stream [fedora-all]

[Bug 1942629] CVE-2021-21347 XStream: allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream

https://bugzilla.redhat.com/show_bug.cgi?id=1942629

--- Comment #1 from Guilherme de Almeida Suckevicz  ---
Created xstream tracking bugs for this issue:

Affects: fedora-all [bug 1942631]

[Bug 1942629] CVE-2021-21347 XStream: allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream

https://bugzilla.redhat.com/show_bug.cgi?id=1942629

Guilherme de Almeida Suckevicz  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Blocks|                            |1942645

[Bug 1942629] CVE-2021-21347 XStream: allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream

https://bugzilla.redhat.com/show_bug.cgi?id=1942629

Chess Hazlett  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
   Fixed In Version|                            |xstream 1.4.16

[Bug 1942629] CVE-2021-21347 XStream: allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream

https://bugzilla.redhat.com/show_bug.cgi?id=1942629

--- Comment #2 from Przemyslaw Roguski  ---
Statement:

OpenShift Container Platform (OCP) delivers Jenkins LTS package with bundled
XStream library. Due to JEP-200 [1] and JEP-228 [2] Jenkins projects, OCP
jenkins package is not affected by this flaw.

[1] https://github.com/jenkinsci/jep/blob/master/jep/200/README.adoc
[2] https://github.com/jenkinsci/jep/blob/master/jep/228/README.adoc#security

[Bug 1942629] CVE-2021-21347 XStream: allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream

https://bugzilla.redhat.com/show_bug.cgi?id=1942629

--- Comment #3 from [e-mail] ---
Statement:

OpenShift Container Platform (OCP) delivers Jenkins LTS package with bundled
XStream library. Due to JEP-200 [1] and JEP-228 [2] Jenkins projects, OCP
Jenkins package is not affected by this flaw.

[1] https://github.com/jenkinsci/jep/blob/master/jep/200/README.adoc
[2] https://github.com/jenkinsci/jep/blob/master/jep/228/README.adoc#security

[Bug 1942629] CVE-2021-21347 XStream: allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream

https://bugzilla.redhat.com/show_bug.cgi?id=1942629

Chess Hazlett  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|medium                      |high
           Severity|medium                      |high

[Bug 1942629] CVE-2021-21347 XStream: allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream

https://bugzilla.redhat.com/show_bug.cgi?id=1942629

Riccardo Schirone  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
         Depends On|                            |1945527

[Bug 1942629] CVE-2021-21347 XStream: allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream

https://bugzilla.redhat.com/show_bug.cgi?id=1942629

--- Doc Text *updated* by Eric Christensen  ---
A flaw was found in xstream. A remote attacker may be able to load and execute arbitrary code from a remote host only by manipulating the processed input stream. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

[Bug 1942629] CVE-2021-21347 XStream: allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream

https://bugzilla.redhat.com/show_bug.cgi?id=1942629

--- Comment #16 from Jonathan Christison  ---
Marking Red Hat Jboss AMQ 6 as having a low impact, AMQ distributes affected
versions of XStream, however its use in AMQ 6 is not susceptible to the
vulnerability as the XStream security framework with an allowlist is in place.

This vulnerability is out of security support scope for the following
products:
 * Red Hat JBoss AMQ 6

Please refer to https://access.redhat.com/support/policy/updates/jboss_notes
for more details.

[Bug 1942629] CVE-2021-21347 XStream: Unsafe deserizaliation of com.sun.tools.javac.processing.JavacProcessingEnvironment NameProcessIterator

https://bugzilla.redhat.com/show_bug.cgi?id=1942629

--- Comment #18 from errata-xmlrpc  ---
This issue has been addressed in the following products:

Red Hat Enterprise Linux 7

Via RHSA-2021:1354 https://access.redhat.com/errata/RHSA-2021:1354

[Bug 1942629] CVE-2021-21347 XStream: Unsafe deserizaliation of com.sun.tools.javac.processing.JavacProcessingEnvironment NameProcessIterator

https://bugzilla.redhat.com/show_bug.cgi?id=1942629

Product Security DevOps Team  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |CLOSED
         Resolution|---                         |ERRATA
        Last Closed|                            |2021-04-26 10:47:02

--- Comment #19 from Product Security DevOps Team  ---
This bug is now closed. Further updates for individual products will be
reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-21347

[Bug 1942629] CVE-2021-21347 XStream: Unsafe deserizaliation of com.sun.tools.javac.processing.JavacProcessingEnvironment NameProcessIterator

https://bugzilla.redhat.com/show_bug.cgi?id=1942629

--- Comment #20 from errata-xmlrpc  ---
This issue has been addressed in the following products:

Red Hat Data Grid 8.2.0

Via RHSA-2021:2139 https://access.redhat.com/errata/RHSA-2021:2139

[Bug 1942629] CVE-2021-21347 XStream: Unsafe deserizaliation of com.sun.tools.javac.processing.JavacProcessingEnvironment NameProcessIterator

https://bugzilla.redhat.com/show_bug.cgi?id=1942629

--- Comment #21 from errata-xmlrpc  ---
This issue has been addressed in the following products:

RHPAM 7.11.0

Via RHSA-2021:2475 https://access.redhat.com/errata/RHSA-2021:2475

[Bug 1942629] CVE-2021-21347 XStream: Unsafe deserizaliation of com.sun.tools.javac.processing.JavacProcessingEnvironment NameProcessIterator

https://bugzilla.redhat.com/show_bug.cgi?id=1942629

errata-xmlrpc  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
            Link ID|                            |Red Hat Product Errata
                   |                            |RHSA-2021:2475

[Bug 1942629] CVE-2021-21347 XStream: Unsafe deserizaliation of com.sun.tools.javac.processing.JavacProcessingEnvironment NameProcessIterator

https://bugzilla.redhat.com/show_bug.cgi?id=1942629

--- Comment #22 from errata-xmlrpc  ---
This issue has been addressed in the following products:

RHDM 7.11.0

Via RHSA-2021:2476 https://access.redhat.com/errata/RHSA-2021:2476

[Bug 1942629] CVE-2021-21347 XStream: Unsafe deserizaliation of com.sun.tools.javac.processing.JavacProcessingEnvironment NameProcessIterator

https://bugzilla.redhat.com/show_bug.cgi?id=1942629

errata-xmlrpc  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
            Link ID|                            |Red Hat Product Errata
                   |                            |RHSA-2021:2476

[Bug 1942629] CVE-2021-21347 XStream: Unsafe deserizaliation of com.sun.tools.javac.processing.JavacProcessingEnvironment NameProcessIterator

https://bugzilla.redhat.com/show_bug.cgi?id=1942629
Bug 1942629 depends on bug 1942631, which changed state.

Bug 1942631 Summary: CVE-2021-21347 xstream: allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1942631

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ON_QA                       |CLOSED
         Resolution|---                         |ERRATA

[Bug 1942629] CVE-2021-21347 XStream: Unsafe deserizaliation of com.sun.tools.javac.processing.JavacProcessingEnvironment NameProcessIterator

https://bugzilla.redhat.com/show_bug.cgi?id=1942629

--- Comment #24 from errata-xmlrpc  ---
This issue has been addressed in the following products:

Red Hat Integration

Via RHSA-2021:4767 https://access.redhat.com/errata/RHSA-2021:4767

[Bug 1942629] CVE-2021-21347 XStream: Unsafe deserizaliation of com.sun.tools.javac.processing.JavacProcessingEnvironment NameProcessIterator

https://bugzilla.redhat.com/show_bug.cgi?id=1942629

errata-xmlrpc  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
            Link ID|                            |Red Hat Product Errata
                   |                            |RHSA-2021:4767

[Bug 1942629] CVE-2021-21347 XStream: Unsafe deserizaliation of com.sun.tools.javac.processing.JavacProcessingEnvironment NameProcessIterator

https://bugzilla.redhat.com/show_bug.cgi?id=1942629

--- Comment #25 from errata-xmlrpc  ---
This issue has been addressed in the following products:

Red Hat Integration

Via RHSA-2021:4918 https://access.redhat.com/errata/RHSA-2021:4918

[Bug 1942629] CVE-2021-21347 XStream: Unsafe deserizaliation of com.sun.tools.javac.processing.JavacProcessingEnvironment NameProcessIterator

https://bugzilla.redhat.com/show_bug.cgi?id=1942629

errata-xmlrpc  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
            Link ID|                            |Red Hat Product Errata
                   |                            |RHSA-2021:4918

[Bug 1942629] CVE-2021-21347 XStream: Unsafe deserizaliation of com.sun.tools.javac.processing.JavacProcessingEnvironment NameProcessIterator

https://bugzilla.redhat.com/show_bug.cgi?id=1942629

--- Comment #26 from errata-xmlrpc  ---
This issue has been addressed in the following products:

Red Hat Fuse 7.10

Via RHSA-2021:5134 https://access.redhat.com/errata/RHSA-2021:5134

[Bug 1942629] CVE-2021-21347 XStream: Unsafe deserizaliation of com.sun.tools.javac.processing.JavacProcessingEnvironment NameProcessIterator

https://bugzilla.redhat.com/show_bug.cgi?id=1942629

errata-xmlrpc  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
            Link ID|                            |Red Hat Product Errata
                   |                            |RHSA-2021:5134