Remote Data Exposure Vulnerability in libxstream-java: CVE-2021-39150
Summary
DEBIAN-CVE-2021-39150: XStream is a simple library to serialize objects to XML and back again. Affects libxstream-java versions < 1.4.15-3+deb11u1. Fixed in 1.4.15-3+deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
libxstream-java is a library designed to facilitate the serialization of Java objects to XML and vice versa. It is widely used for its simplicity and effectiveness in handling object data. However, certain versions of this library have been found to be vulnerable to a security issue that could allow unauthorized access to internal resources.
Vulnerability Detail
The vulnerability identified as CVE-2021-39150 allows a remote attacker to exploit affected versions of libxstream-java by manipulating the input stream processed by the library. This could lead to unauthorized access to sensitive internal resources that are not intended for public exposure. The issue arises when the library's security framework is not properly configured, particularly if the default blacklist is used instead of a whitelist that limits access to only necessary types. Users running Java versions 8 to 14 are particularly at risk if they do not implement the recommended security measures.
How To Fix
Minimum fixed version
1.4.15-3+deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libxstream-javaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider implementing a security framework configuration that utilizes a whitelist of allowed types. This can be done by modifying the XStream security settings in your application code as follows:
XStream xstream = new XStream();
// Allow only specific classes
xstream.allowTypes(new Class[]{YourAllowedClass.class});
Conclusion
The CVE-2021-39150 vulnerability in libxstream-java poses a significant risk of unauthorized access to internal resources. It is crucial for users to update to the latest patched versions and configure their security settings appropriately to safeguard their applications.
See every vulnerability recorded for libxstream-java →
FAQ
CVE-2021-39150 is a vulnerability in the libxstream-java library that allows remote attackers to access internal resources by manipulating the input stream.
Affected versions include those prior to 1.4.15-3+deb11u1 for Debian 11 and prior to 1.4.18-1 for Debian 12, 13, and 14.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Implement a security framework configuration that uses a whitelist of allowed types to mitigate the risk until you can update.
Vulert is a service that monitors and alerts in real-time for open-source vulnerabilities in software using just a manifest file like package-lock.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for libxstream-java.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
