Denial of Service Vulnerability in libxstream-java: CPU Resource Exhaustion
Summary
CVE-2021-43859: XStream is an open source java library to serialize objects to XML and back again. Affects libxstream-java across 3 version ranges.
< 1.4.15-3+deb11u3
< 8a29e8858b49da45c0071f690d4ceebe8db2f18f
< e8e88621ba1c85ac3b8620337dd672e0c0c3a846
Fixed in 1.4.15-3+deb11u3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libxstream-java is an open-source Java library that facilitates the serialization of objects to XML and vice versa. It is widely used in various applications for its ability to convert Java objects into XML format, making data interchange easier. However, certain versions of this library are susceptible to a vulnerability that can lead to significant resource exhaustion, particularly CPU time, when processing specially crafted input streams.
Vulnerability Detail
The vulnerability, identified as CVE-2021-43859, affects versions of libxstream-java prior to 1.4.19. It allows a remote attacker to manipulate the input stream in such a way that it can cause the target system to allocate 100% of its CPU resources. This can result in a denial of service, making the application unresponsive. The issue arises from the way the library handles the addition of elements to collections, where excessive recursion can occur, leading to high CPU usage.
How To Fix
Minimum fixed version
1.4.15-3+deb11u3
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libxstream-javaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately feasible, users can set the NO_REFERENCE mode in the library to prevent recursion. This can be done by configuring the XStream instance as follows:
XStream xstream = new XStream();
xstream.setMode(XStream.NO_REFERENCES);
Conclusion
CVE-2021-43859 presents a significant risk to applications using libxstream-java prior to version 1.4.19. It is crucial for users to upgrade to the latest version to mitigate the risk of denial of service attacks. For those unable to upgrade immediately, implementing the NO_REFERENCE mode serves as a temporary workaround.
See every vulnerability recorded for libxstream-java →
FAQ
CVE-2021-43859 is a vulnerability in libxstream-java that can lead to denial of service by exhausting CPU resources through specially crafted input streams.
Versions prior to 1.4.19 of libxstream-java are affected by this vulnerability.
An attacker can exploit this vulnerability to make the application unresponsive, leading to a denial of service.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability.
The CVSS score for CVE-2021-43859 is 7.5, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for libxstream-java.
