CVE-2021-29505

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2021-29505
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2021-29505.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2021-29505
Aliases
Downstream
Related
Published
2021-05-28T21:15:08Z
Modified
2025-10-13T10:48:29.491196Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

XStream is software for serializing Java objects to XML and back again. A vulnerability in XStream versions prior to 1.4.17 may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types is affected. The vulnerability is patched in version 1.4.17.

References

Affected packages

Git / github.com/x-stream/xstream

Affected ranges

Type
GIT
Repo
https://github.com/x-stream/xstream
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
24fac82191292c6ae25f94508d28b9823f83624f
Fixed
f0c4a8d861b68ffc3119cfbbbd632deee624e227

Affected versions

Other

XSTREAM_1_4_10
XSTREAM_1_4_11
XSTREAM_1_4_11_1
XSTREAM_1_4_12
XSTREAM_1_4_13
XSTREAM_1_4_14
XSTREAM_1_4_15
XSTREAM_1_4_16
XSTREAM_1_4_5
XSTREAM_1_4_9

Database specific 

{
    "vanir_signatures": [
        {
            "deprecated": false,
            "id": "CVE-2021-29505-01e2ea1b",
            "signature_version": "v1",
            "digest": {
                "length": 897.0,
                "function_hash": "55529827059998388985835589218509171525"
            },
            "signature_type": "Function",
            "target": {
                "function": "setupSecurity",
                "file": "xstream/src/java/com/thoughtworks/xstream/XStream.java"
            },
            "source": "https://github.com/x-stream/xstream/commit/f0c4a8d861b68ffc3119cfbbbd632deee624e227"
        },
        {
            "deprecated": false,
            "id": "CVE-2021-29505-734e63e4",
            "signature_version": "v1",
            "digest": {
                "line_hashes": [
                    "228053600362383738383378574221655207960",
                    "315590729455584714180717487731983745448",
                    "257878284676754907993801838307504860032",
                    "231257142268735163893318086460227527786",
                    "183765047426471769504861481430198288414",
                    "161229857215197968276439161291882057455",
                    "304544354710807799641371135251598970303",
                    "264527588790798306887948232623981151266",
                    "87393381625111131561526952720266719235",
                    "130273361020895782069120355560557146251",
                    "154828802101872288206305236334275778530",
                    "259768556357375405967654864082038448418",
                    "74605625453746711180847749475408939299",
                    "204716482209653724790252231288128673691"
                ],
                "threshold": 0.9
            },
            "signature_type": "Line",
            "target": {
                "file": "xstream/src/java/com/thoughtworks/xstream/XStream.java"
            },
            "source": "https://github.com/x-stream/xstream/commit/f0c4a8d861b68ffc3119cfbbbd632deee624e227"
        }
    ]
}