Denial of Service Vulnerability in libxstream-java: CVE-2021-39140
Summary
CVE-2021-39140: XStream is a simple library to serialize objects to XML and back again. Affects libxstream-java across 2 version ranges.
< 1.4.15-3+deb11u1
< b9ad1c02724c2b1636a8794c8e1bcd630f46c0b3
Fixed in 1.4.15-3+deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
XStream is a popular open-source library that facilitates the serialization of Java objects to XML and vice versa. It is widely used for its simplicity and flexibility, allowing developers to easily convert complex data structures into a format that can be easily transmitted or stored. However, certain versions of XStream have been found to be vulnerable to a denial of service attack, which can significantly impact system performance.
Vulnerability Detail
CVE-2021-39140 is a vulnerability in XStream that allows a remote attacker to manipulate the processed input stream, potentially leading to 100% CPU usage on the target system. This can occur depending on the CPU type or if multiple instances of the payload are executed in parallel. The vulnerability arises from the library's handling of input streams without adequate security measures, particularly in versions prior to 1.4.18. Users who have not implemented XStream's security framework with a strict whitelist of required types are at risk of exploitation, which could result in a denial of service condition.
How To Fix
Minimum fixed version
1.4.15-3+deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libxstream-javaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing XStream's security framework by setting up a whitelist of the minimal required types to mitigate the risk of exploitation. This can be done by configuring the XStream instance as follows:
XStream xstream = new XStream();
// Allow only specific classes
xstream.allowTypes(new Class[]{YourClass.class});
Conclusion
CVE-2021-39140 poses a significant risk to systems using vulnerable versions of the XStream library, potentially leading to denial of service. Users are strongly advised to upgrade to the latest versions or implement security measures to mitigate the risk. Regular monitoring for vulnerabilities using tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for libxstream-java →
FAQ
CVE-2021-39140 is a vulnerability in the XStream library that can lead to denial of service by consuming 100% CPU time on the target system.
Affected versions include those prior to 1.4.18 for Debian 12 and 13, and prior to 1.4.15-3+deb11u1 for Debian 11.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Implement XStream's security framework by setting up a whitelist of required types to reduce the risk of exploitation.
The CVSS score for CVE-2021-39140 is 6.3, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for libxstream-java.
