CVE-2021-39150

XStream is a library to serialize objects to XML and back. This vulnerability allows a remote attacker to request data from internal resources not publicly available by manipulating the processed input stream with Java runtime version 14 to 8. Users who followed the recommendation to set up XStream's security framework with a whitelist limited to minimal required types are not affected. If relying on the default blacklist of the Security Framework, you must use at least version 1.4.18.

XStream, a library for serializing objects to and from XML, in affected versions may allow a remote attacker to allocate 100% CPU time on the target system by manipulating the processed input stream, resulting in a denial of service. Users who followed the recommendation to set up XStream's security framework with a whitelist limited to the minimal required types are not affected.

XStream is a library to serialize objects to XML and back. This vulnerability allows a remote attacker to load and execute arbitrary code from a remote host by manipulating the processed input stream. Users who followed the recommendation to set up XStream's security framework with a whitelist limited to minimal required types are not affected. XStream 1.4.18 no longer uses a blacklist by default, as it cannot be secured for general purpose.

XStream is a library for serializing objects to XML and back. The vulnerability allows a remote attacker to execute arbitrary code from a remote host by manipulating the processed input stream, if using the version out of the box with Java runtime version 14 to 8 or with JavaFX installed. Users who configured the security framework with a whitelist are not affected. Version 1.4.18 no longer uses a blacklist by default.

XStream is a library to serialize objects to XML and back. This vulnerability allows a remote attacker to load and execute arbitrary code from a remote host by manipulating the processed input stream. Users who followed the recommendation to set up XStream's security framework with a whitelist limited to minimal required types are not affected. XStream 1.4.18 no longer uses a blacklist by default, as it cannot be secured for general purpose.

XStream is a library for serializing objects to XML and back. The vulnerability allows a remote attacker to execute arbitrary code from a remote host by manipulating the processed input stream. Users who configured XStream's security framework with a whitelist limited to minimal required types are not affected. Version 1.4.18 no longer uses a blacklist by default, as it cannot be secured for general purpose.

XStream is a library for serializing objects to XML and back. The vulnerability allows a remote attacker to execute arbitrary code from a remote host by manipulating the processed input stream. Users who configured XStream's security framework with a whitelist limited to minimal required types are not affected. Version 1.4.18 no longer uses a blacklist by default, as it cannot be secured for general purpose.

XStream is a library for serializing objects to XML and back. The vulnerability allows a remote attacker to execute arbitrary code from a remote host by manipulating the processed input stream. Users who configured XStream's security framework with a whitelist limited to minimal required types are not affected. Version 1.4.18 no longer uses a blacklist by default, as it cannot be secured for general purpose.

XStream is a library to serialize objects to XML and back. This vulnerability allows a remote attacker to load and execute arbitrary code from a remote host by manipulating the processed input stream. Users who followed the recommendation to set up XStream's security framework with a whitelist limited to minimal required types are not affected. XStream 1.4.18 no longer uses a blacklist by default, as it cannot be secured for general purpose.

XStream is a library for serializing objects to XML and back. The vulnerability allows a remote attacker to execute arbitrary code from a remote host by manipulating the processed input stream. Users who configured XStream's security framework with a whitelist limited to minimal required types are not affected. Version 1.4.18 no longer uses a blacklist by default, as it cannot be secured for general purpose.