Critical Remote Code Execution Vulnerability in libxstream-java
Summary
DEBIAN-CVE-2021-39145: XStream is a simple library to serialize objects to XML and back again. Affects libxstream-java versions < 1.4.15-3+deb11u1. Fixed in 1.4.15-3+deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libxstream-java is a Java library that facilitates the serialization of objects to XML and vice versa. It is widely used in applications that require data interchange in XML format. The library is designed to be flexible and easy to use, but its functionality can also introduce security risks if not properly configured. This vulnerability allows for the potential execution of arbitrary code, making it crucial for users to ensure they are using a secure version.
Vulnerability Detail
The vulnerability identified as DEBIAN-CVE-2021-39145 affects versions of libxstream-java prior to 1.4.15-3+deb11u1 for Debian 11 and prior to 1.4.18-1 for Debian 12, 13, and 14. It arises from the library's handling of input streams, which can be manipulated by a remote attacker to load and execute arbitrary code from a remote host. This poses a significant risk, especially for applications that do not implement XStream's security framework with a restricted whitelist of types.
How To Fix
Minimum fixed version
1.4.15-3+deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libxstream-javaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not possible, consider implementing XStream's security framework by configuring a whitelist that limits the types that can be processed. This can help mitigate the risk until an update can be applied.
Conclusion
The vulnerability in libxstream-java poses a significant risk due to its potential for remote code execution. Users are strongly advised to update to the latest patched versions to mitigate this risk. Implementing security best practices, such as using a whitelist, can also help protect applications until updates are applied.
See every vulnerability recorded for libxstream-java →
FAQ
libxstream-java is a Java library used for serializing objects to XML and deserializing XML back to objects.
The vulnerability allows a remote attacker to load and execute arbitrary code from a remote host by manipulating the input stream.
You can use Vulert's playground at Vulert Scanner to check if your application is affected without needing to sign up.
Implement a security framework with a whitelist in XStream to limit the types processed until you can apply the update.
More details can be found in the official Debian CVE database at https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2021-39145.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for libxstream-java.
