CVE-2021-39154

XStream is a library to serialize objects to XML and back. This vulnerability allows a remote attacker to request data from internal resources not publicly available by manipulating the processed input stream with Java runtime version 14 to 8. Users who followed the recommendation to set up XStream's security framework with a whitelist limited to minimal required types are not affected. If relying on the default blacklist of the Security Framework, you must use at least version 1.4.18.

XStream is a library for serializing objects to XML and back. The vulnerability allows a remote attacker to execute arbitrary code from a remote host by manipulating the processed input stream, if using the version out of the box with Java runtime version 14 to 8 or with JavaFX installed. Users who configured the security framework with a whitelist are not affected. Version 1.4.18 no longer uses a blacklist by default.

XStream is a library to serialize objects to XML and back. This vulnerability allows a remote attacker to load and execute arbitrary code from a remote host by manipulating the processed input stream. Users who followed the recommendation to set up XStream's security framework with a whitelist limited to minimal required types are not affected. XStream 1.4.18 no longer uses a blacklist by default, as it cannot be secured for general purpose.

XStream is a library for serializing objects to XML and back. The vulnerability allows a remote attacker to execute arbitrary code from a remote host by manipulating the processed input stream. Users who configured XStream's security framework with a whitelist limited to minimal required types are not affected. Version 1.4.18 no longer uses a blacklist by default, as it cannot be secured for general purpose.

XStream is a library for serializing objects to XML and back. The vulnerability allows a remote attacker to execute arbitrary code from a remote host by manipulating the processed input stream. Users who configured XStream's security framework with a whitelist limited to minimal required types are not affected. Version 1.4.18 no longer uses a blacklist by default, as it cannot be secured for general purpose.

XStream is a library for serializing objects to XML and back. The vulnerability allows a remote attacker to execute arbitrary code from a remote host by manipulating the processed input stream. Users who configured XStream's security framework with a whitelist limited to minimal required types are not affected. Version 1.4.18 no longer uses a blacklist by default, as it cannot be secured for general purpose.

XStream is a library to serialize objects to XML and back. This vulnerability allows a remote attacker to load and execute arbitrary code from a remote host by manipulating the processed input stream. Users who followed the recommendation to set up XStream's security framework with a whitelist limited to minimal required types are not affected. XStream 1.4.18 no longer uses a blacklist by default, as it cannot be secured for general purpose.

XStream is a library for serializing objects to XML and back. The vulnerability allows a remote attacker to execute arbitrary code from a remote host by manipulating the processed input stream. Users who configured XStream's security framework with a whitelist limited to minimal required types are not affected. Version 1.4.18 no longer uses a blacklist by default, as it cannot be secured for general purpose.

Vulnerability in XStream in affected versions allows a remote attacker to load and execute arbitrary code from a remote host by manipulating the processed input stream. Users following the whitelist recommendation are not affected.