Denial of Service Vulnerability in libxstream-java: Remote CPU Exhaustion Risk
Summary
DEBIAN-CVE-2021-43859: XStream is an open source java library to serialize objects to XML and back again. Affects libxstream-java versions < 1.4.15-3+deb11u3. Fixed in 1.4.15-3+deb11u3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libxstream-java is an open-source Java library designed for serializing objects to XML and deserializing XML back into objects. It is widely used in applications that require data interchange in XML format. The library's functionality allows for easy conversion between Java objects and XML, making it a popular choice among developers. However, certain versions of libxstream-java are vulnerable to a denial of service attack, which can severely impact system performance.
Vulnerability Detail
The vulnerability identified as DEBIAN-CVE-2021-43859 affects versions of libxstream-java prior to 1.4.19. It allows a remote attacker to exploit the library by manipulating the processed input stream, potentially leading to 100% CPU utilization on the target system. This can occur depending on the CPU type or the parallel execution of the payload, resulting in a denial of service. The vulnerability arises from the library's handling of collection elements, which can be exploited to exhaust system resources.
How To Fix
Minimum fixed version
1.4.15-3+deb11u3
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libxstream-javaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, users can set the NO_REFERENCE mode in libxstream-java to prevent recursion. This can be done by configuring the library settings in the application code to limit the processing of input streams.
Conclusion
The vulnerability in libxstream-java poses a significant risk of denial of service due to CPU exhaustion. It is crucial for users to upgrade to the latest patched versions to protect their systems. Additionally, implementing the NO_REFERENCE mode can serve as a temporary workaround until an upgrade can be performed.
See every vulnerability recorded for libxstream-java →
FAQ
The vulnerability allows remote attackers to exhaust CPU resources, leading to a denial of service.
Versions prior to 1.4.19 are vulnerable to this issue.
You can use Vulert's playground at Vulert Scanner to check for vulnerabilities without needing to sign up.
Upgrade to the patched version of libxstream-java as soon as possible.
Yes, you can set the NO_REFERENCE mode to prevent recursion in the library.
References
Related vulnerabilities
Recent vulnerabilities recorded for libxstream-java.
