CVE-2021-29505
- Source
- https://cve.org/CVERecord?id=CVE-2021-29505
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2021-29505.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2021-29505
- Aliases
- Downstream
- Related
- Published
- 2021-05-28T21:15:08.713Z
- Modified
- 2026-04-16T00:00:29.595583701Z
- Severity
-
- 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- [none]
- Details
-
XStream is software for serializing Java objects to XML and back again. A vulnerability in XStream versions prior to 1.4.17 may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types is affected. The vulnerability is patched in version 1.4.17.
- Database specific
{ "unresolved_ranges": [ { "source": "CPE_FIELD", "cpe": "cpe:2.3:a:oracle:banking_cash_management:14.2:*:*:*:*:*:*:*", "extracted_events": [ { "last_affected": "14.2" } ] }, { "source": "CPE_FIELD", "cpe": "cpe:2.3:a:oracle:banking_cash_management:14.3:*:*:*:*:*:*:*", "extracted_events": [ { "last_affected": "14.3" } ] }, { "source": "CPE_FIELD", "cpe": "cpe:2.3:a:oracle:banking_cash_management:14.5:*:*:*:*:*:*:*", "extracted_events": [ { "last_affected": "14.5" } ] }, { "source": "CPE_FIELD", "cpe": "cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.2.0:*:*:*:*:*:*:*", "extracted_events": [ { "last_affected": "14.2.0" } ] }, { "source": "CPE_FIELD", "cpe": "cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.3.0:*:*:*:*:*:*:*", "extracted_events": [ { "last_affected": "14.3.0" } ] }, { "source": "CPE_FIELD", "cpe": "cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.5.0:*:*:*:*:*:*:*", "extracted_events": [ { "last_affected": "14.5.0" } ] }, { "source": "CPE_FIELD", "cpe": "cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.2.0:*:*:*:*:*:*:*", "extracted_events": [ { "last_affected": "14.2.0" } ] }, { "source": "CPE_FIELD", "cpe": "cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.3.0:*:*:*:*:*:*:*", "extracted_events": [ { "last_affected": "14.3.0" } ] }, { "source": "CPE_FIELD", "cpe": "cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.5.0:*:*:*:*:*:*:*", "extracted_events": [ { "last_affected": "14.5.0" } ] }, { "source": "CPE_FIELD", "cpe": "cpe:2.3:a:oracle:banking_supply_chain_finance:14.2.0:*:*:*:*:*:*:*", "extracted_events": [ { "last_affected": "14.2.0" } ] }, { "source": "CPE_FIELD", "cpe": "cpe:2.3:a:oracle:banking_trade_finance_process_management:14.5.0:*:*:*:*:*:*:*", "extracted_events": [ { "last_affected": "14.5.0" } ] }, { "source": "CPE_FIELD", "cpe": "cpe:2.3:a:oracle:business_activity_monitoring:11.1.1.9.0:*:*:*:*:*:*:*", "extracted_events": [ { "last_affected": "11.1.1.9.0" } ] }, { "source": "CPE_FIELD", "cpe": "cpe:2.3:a:oracle:business_activity_monitoring:12.2.1.3.0:*:*:*:*:*:*:*", "extracted_events": [ { "last_affected": "12.2.1.3.0" } ] }, { "source": "CPE_FIELD", "cpe": "cpe:2.3:a:oracle:business_activity_monitoring:12.2.1.4.0:*:*:*:*:*:*:*", "extracted_events": [ { "last_affected": "12.2.1.4.0" } ] }, { "source": "CPE_FIELD", "cpe": "cpe:2.3:a:oracle:communications_brm_-_elastic_charging_engine:11.3:*:*:*:*:*:*:*", "extracted_events": [ { "last_affected": "11.3" } ] }, { "source": "CPE_FIELD", "cpe": "cpe:2.3:a:oracle:communications_brm_-_elastic_charging_engine:12.0:*:*:*:*:*:*:*", "extracted_events": [ { "last_affected": "12.0" } ] }, { "source": "CPE_FIELD", "cpe": "cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.4:*:*:*:*:*:*:*", "extracted_events": [ { "last_affected": "7.3.4" } ] }, { "source": "CPE_FIELD", "cpe": "cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.5:*:*:*:*:*:*:*", "extracted_events": [ { "last_affected": "7.3.5" } ] }, { "source": "CPE_FIELD", "cpe": "cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.0:*:*:*:*:*:*:*", "extracted_events": [ { "last_affected": "7.4.0" } ] }, { "source": "CPE_FIELD", "cpe": "cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.1:*:*:*:*:*:*:*", "extracted_events": [ { "last_affected": "7.4.1" } ] }, { "source": "CPE_FIELD", "cpe": "cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.2:*:*:*:*:*:*:*", "extracted_events": [ { "last_affected": "7.4.2" } ] }, { "source": "CPE_FIELD", "cpe": "cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0.0:*:*:*:*:*:*:*", "extracted_events": [ { "last_affected": "12.4.0.0" } ] }, { "source": "CPE_FIELD", "cpe": "cpe:2.3:a:oracle:retail_customer_insights:15.0.2:*:*:*:*:*:*:*", "extracted_events": [ { "last_affected": "15.0.2" } ] }, { "source": "CPE_FIELD", "cpe": "cpe:2.3:a:oracle:retail_customer_insights:16.0.2:*:*:*:*:*:*:*", "extracted_events": [ { "last_affected": "16.0.2" } ] }, { "source": "CPE_FIELD", "cpe": "cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0.6:*:*:*:*:*:*:*", "extracted_events": [ { "last_affected": "16.0.6" } ] }, { "source": "CPE_FIELD", "cpe": "cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0.4:*:*:*:*:*:*:*", "extracted_events": [ { "last_affected": "17.0.4" } ] }, { "source": "CPE_FIELD", "cpe": "cpe:2.3:a:oracle:retail_xstore_point_of_service:18.0.3:*:*:*:*:*:*:*", "extracted_events": [ { "last_affected": "18.0.3" } ] }, { "source": "CPE_FIELD", "cpe": "cpe:2.3:a:oracle:retail_xstore_point_of_service:19.0.2:*:*:*:*:*:*:*", "extracted_events": [ { "last_affected": "19.0.2" } ] }, { "source": "CPE_FIELD", "cpe": "cpe:2.3:a:oracle:retail_xstore_point_of_service:20.0.1:*:*:*:*:*:*:*", "extracted_events": [ { "last_affected": "20.0.1" } ] }, { "source": "CPE_FIELD", "cpe": "cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:*", "extracted_events": [ { "last_affected": "12.2.1.3.0" } ] }, { "source": "CPE_FIELD", "cpe": "cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0:*:*:*:*:*:*:*", "extracted_events": [ { "last_affected": "12.2.1.4.0" } ] }, { "source": "CPE_FIELD", "cpe": "cpe:2.3:a:oracle:webcenter_sites:12.2.1.3.0:*:*:*:*:*:*:*", "extracted_events": [ { "last_affected": "12.2.1.3.0" } ] }, { "source": "CPE_FIELD", "cpe": "cpe:2.3:a:oracle:webcenter_sites:12.2.1.4.0:*:*:*:*:*:*:*", "extracted_events": [ { "last_affected": "12.2.1.4.0" } ] }, { "source": "CPE_FIELD", "cpe": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*", "extracted_events": [ { "last_affected": "10.0" } ] }, { "source": "CPE_FIELD", "cpe": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*", "extracted_events": [ { "last_affected": "11.0" } ] }, { "source": "CPE_FIELD", "cpe": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*", "extracted_events": [ { "last_affected": "9.0" } ] }, { "source": "CPE_FIELD", "cpe": "cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*", "extracted_events": [ { "last_affected": "33" } ] }, { "source": "CPE_FIELD", "cpe": "cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*", "extracted_events": [ { "last_affected": "34" } ] }, { "source": "CPE_FIELD", "cpe": "cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*", "extracted_events": [ { "last_affected": "35" } ] } ] }- References
-
- https://lists.apache.org/thread.html/r8ee51debf7fd184b6a6b020dc31df25118b0aa612885f12fbe77f04f@%3Cdev.jmeter.apache.org%3E
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB
- https://x-stream.github.io/CVE-2021-29505.html
- https://github.com/x-stream/xstream/security/advisories/GHSA-7chv-rrw6-w6fc
- https://lists.debian.org/debian-lts-announce/2021/07/msg00004.html
- https://security.netapp.com/advisory/ntap-20210708-0007
- https://security.netapp.com/advisory/ntap-20210708-0007/
- https://www.debian.org/security/2021/dsa-5004
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://lists.apache.org/thread.html/r8ee51debf7fd184b6a6b020dc31df25118b0aa612885f12fbe77f04f%40%3Cdev.jmeter.apache.org%3E
- https://github.com/x-stream/xstream/commit/24fac82191292c6ae25f94508d28b9823f83624f
- https://github.com/x-stream/xstream/commit/f0c4a8d861b68ffc3119cfbbbd632deee624e227
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/
Affected packages
Git / github.com/x-stream/xstream
Affected ranges
- Type
- GIT
- Repo
- https://github.com/x-stream/xstream
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixedFixedFixed
- Database specific
{ "source": [ "CPE_FIELD", "REFERENCES" ], "cpe": "cpe:2.3:a:xstream:xstream:*:*:*:*:*:*:*:*", "extracted_events": [ { "introduced": "0" }, { "fixed": "1.4.17" } ] }
Affected versions
Other
XSTREAM_1_4_10
XSTREAM_1_4_11
XSTREAM_1_4_11_1
XSTREAM_1_4_12
XSTREAM_1_4_13
XSTREAM_1_4_14
XSTREAM_1_4_15
XSTREAM_1_4_16
XSTREAM_1_4_5
XSTREAM_1_4_9
Database specific
source
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2021-29505.json"
vanir_signatures_modified
"2026-04-12T02:45:37Z"
vanir_signatures
[
{
"source": "https://github.com/x-stream/xstream/commit/f0c4a8d861b68ffc3119cfbbbd632deee624e227",
"digest": {
"function_hash": "55529827059998388985835589218509171525",
"length": 897.0
},
"signature_type": "Function",
"target": {
"function": "setupSecurity",
"file": "xstream/src/java/com/thoughtworks/xstream/XStream.java"
},
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2021-29505-01e2ea1b"
},
{
"source": "https://github.com/x-stream/xstream/commit/f0c4a8d861b68ffc3119cfbbbd632deee624e227",
"digest": {
"line_hashes": [
"228053600362383738383378574221655207960",
"315590729455584714180717487731983745448",
"257878284676754907993801838307504860032",
"231257142268735163893318086460227527786",
"183765047426471769504861481430198288414",
"161229857215197968276439161291882057455",
"304544354710807799641371135251598970303",
"264527588790798306887948232623981151266",
"87393381625111131561526952720266719235",
"130273361020895782069120355560557146251",
"154828802101872288206305236334275778530",
"259768556357375405967654864082038448418",
"74605625453746711180847749475408939299",
"204716482209653724790252231288128673691"
],
"threshold": 0.9
},
"id": "CVE-2021-29505-734e63e4",
"signature_version": "v1",
"target": {
"file": "xstream/src/java/com/thoughtworks/xstream/XStream.java"
},
"signature_type": "Line",
"deprecated": false
}
]