CVE-2021-29505

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2021-29505
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2021-29505.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2021-29505
Aliases
Downstream
Related
Published
2021-05-28T21:15:08.713Z
Modified
2025-11-14T11:37:10.012911Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

XStream is software for serializing Java objects to XML and back again. A vulnerability in XStream versions prior to 1.4.17 may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types is affected. The vulnerability is patched in version 1.4.17.

References

Affected packages

Git / github.com/x-stream/xstream

Affected ranges

Type
GIT
Repo
https://github.com/x-stream/xstream
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
24fac82191292c6ae25f94508d28b9823f83624f
Fixed
f0c4a8d861b68ffc3119cfbbbd632deee624e227

Affected versions

Other

XSTREAM_1_4_10
XSTREAM_1_4_11
XSTREAM_1_4_11_1
XSTREAM_1_4_12
XSTREAM_1_4_13
XSTREAM_1_4_14
XSTREAM_1_4_15
XSTREAM_1_4_16
XSTREAM_1_4_5
XSTREAM_1_4_9

Database specific

vanir_signatures

[
    {
        "signature_version": "v1",
        "digest": {
            "function_hash": "55529827059998388985835589218509171525",
            "length": 897.0
        },
        "signature_type": "Function",
        "target": {
            "function": "setupSecurity",
            "file": "xstream/src/java/com/thoughtworks/xstream/XStream.java"
        },
        "deprecated": false,
        "id": "CVE-2021-29505-01e2ea1b",
        "source": "https://github.com/x-stream/xstream/commit/f0c4a8d861b68ffc3119cfbbbd632deee624e227"
    },
    {
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "228053600362383738383378574221655207960",
                "315590729455584714180717487731983745448",
                "257878284676754907993801838307504860032",
                "231257142268735163893318086460227527786",
                "183765047426471769504861481430198288414",
                "161229857215197968276439161291882057455",
                "304544354710807799641371135251598970303",
                "264527588790798306887948232623981151266",
                "87393381625111131561526952720266719235",
                "130273361020895782069120355560557146251",
                "154828802101872288206305236334275778530",
                "259768556357375405967654864082038448418",
                "74605625453746711180847749475408939299",
                "204716482209653724790252231288128673691"
            ],
            "threshold": 0.9
        },
        "signature_type": "Line",
        "target": {
            "file": "xstream/src/java/com/thoughtworks/xstream/XStream.java"
        },
        "deprecated": false,
        "id": "CVE-2021-29505-734e63e4",
        "source": "https://github.com/x-stream/xstream/commit/f0c4a8d861b68ffc3119cfbbbd632deee624e227"
    }
]