CVE-2021-39152

XStream is a library to serialize objects to XML and back. This vulnerability allows a remote attacker to load and execute arbitrary code from a remote host by manipulating the processed input stream. Users who followed the recommendation to set up XStream's security framework with a whitelist limited to minimal required types are not affected. XStream 1.4.18 no longer uses a blacklist by default, as it cannot be secured for general purpose.

XStream is a library for serializing objects to XML and back. The vulnerability allows a remote attacker to execute arbitrary code from a remote host by manipulating the processed input stream, if using the version out of the box with Java runtime version 14 to 8 or with JavaFX installed. Users who configured the security framework with a whitelist are not affected. Version 1.4.18 no longer uses a blacklist by default.

XStream is a library to serialize objects to XML and back. This vulnerability allows a remote attacker to load and execute arbitrary code from a remote host by manipulating the processed input stream. Users who followed the recommendation to set up XStream's security framework with a whitelist limited to minimal required types are not affected. XStream 1.4.18 no longer uses a blacklist by default, as it cannot be secured for general purpose.

XStream is a library for serializing objects to XML and back. The vulnerability allows a remote attacker to execute arbitrary code from a remote host by manipulating the processed input stream. Users who configured XStream's security framework with a whitelist limited to minimal required types are not affected. Version 1.4.18 no longer uses a blacklist by default, as it cannot be secured for general purpose.

XStream is a library for serializing objects to XML and back. The vulnerability allows a remote attacker to execute arbitrary code from a remote host by manipulating the processed input stream. Users who configured XStream's security framework with a whitelist limited to minimal required types are not affected. Version 1.4.18 no longer uses a blacklist by default, as it cannot be secured for general purpose.

XStream is a library for serializing objects to XML and back. The vulnerability allows a remote attacker to execute arbitrary code from a remote host by manipulating the processed input stream. Users who configured XStream's security framework with a whitelist limited to minimal required types are not affected. Version 1.4.18 no longer uses a blacklist by default, as it cannot be secured for general purpose.

XStream is a library to serialize objects to XML and back. This vulnerability allows a remote attacker to load and execute arbitrary code from a remote host by manipulating the processed input stream. Users who followed the recommendation to set up XStream's security framework with a whitelist limited to minimal required types are not affected. XStream 1.4.18 no longer uses a blacklist by default, as it cannot be secured for general purpose.

XStream is a library for serializing objects to XML and back. The vulnerability allows a remote attacker to execute arbitrary code from a remote host by manipulating the processed input stream. Users who configured XStream's security framework with a whitelist limited to minimal required types are not affected. Version 1.4.18 no longer uses a blacklist by default, as it cannot be secured for general purpose.

Vulnerability in XStream in affected versions allows a remote attacker to load and execute arbitrary code from a remote host by manipulating the processed input stream. Users following the whitelist recommendation are not affected.