XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a payload resulting in a denial of service only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.
References
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
Configuration 4 (hide)
|
Configuration 5 (hide)
|
History
25 Jul 2022, 18:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
20 Apr 2022, 00:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
16 Feb 2022, 15:50
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:oracle:utilities_framework:4.4.0.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_billing_and_revenue_management_elastic_charging_engine:11.3:*:*:*:*:*:*:* cpe:2.3:a:oracle:utilities_framework:4.3.0.1.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:utilities_testing_accelerator:6.0.0.1.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:utilities_framework:4.2.0.2.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:utilities_framework:4.2.0.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:1.10.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:utilities_framework:4.4.0.0.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.5:*:*:*:*:*:*:* cpe:2.3:a:oracle:business_activity_monitoring:12.2.1.4.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:utilities_framework:4.4.0.2.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_billing_and_revenue_management_elastic_charging_engine:12.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.14.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:utilities_framework:4.3.0.6.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.4:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.1:*:*:*:*:*:*:* |
|
| CVSS |
v2 : v3 : |
v2 : 6.3
v3 : 6.3 |
| References | (MISC) https://www.oracle.com/security-alerts/cpujan2022.html - Patch, Third Party Advisory |
07 Feb 2022, 16:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
30 Nov 2021, 21:55
| Type | Values Removed | Values Added |
|---|---|---|
| References | (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/ - Mailing List, Third Party Advisory | |
| References | (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/ - Mailing List, Third Party Advisory | |
| References | (DEBIAN) https://www.debian.org/security/2021/dsa-5004 - Third Party Advisory | |
| References | (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/ - Mailing List, Third Party Advisory | |
| CPE | cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:sap:*:* cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:oracle:*:* cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* |
11 Nov 2021, 23:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
30 Oct 2021, 02:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
13 Oct 2021, 02:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
07 Oct 2021, 19:11
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | |
| References | (MLIST) https://lists.debian.org/debian-lts-announce/2021/09/msg00017.html - Mailing List, Third Party Advisory | |
| References | (CONFIRM) https://security.netapp.com/advisory/ntap-20210923-0003/ - Third Party Advisory |
30 Sep 2021, 10:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
23 Sep 2021, 13:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
31 Aug 2021, 14:20
| Type | Values Removed | Values Added |
|---|---|---|
| References | (CONFIRM) https://github.com/x-stream/xstream/security/advisories/GHSA-6wf9-jmg9-vxcc - Third Party Advisory | |
| References | (MISC) https://x-stream.github.io/CVE-2021-39140.html - Exploit, Third Party Advisory | |
| CVSS |
v2 : v3 : |
v2 : 3.5
v3 : 6.3 |
| CPE | cpe:2.3:a:xstream_project:xstream:*:*:*:*:*:*:*:* |
23 Aug 2021, 19:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2021-08-23 19:15
Updated : 2024-02-04 21:47
NVD link : CVE-2021-39140
Mitre link : CVE-2021-39140
CVE.ORG link : CVE-2021-39140
JSON object : View
Products Affected
xstream_project
- xstream
oracle
- communications_cloud_native_core_binding_support_function
- utilities_testing_accelerator
- communications_billing_and_revenue_management_elastic_charging_engine
- webcenter_portal
- utilities_framework
- communications_cloud_native_core_policy
- commerce_guided_search
- retail_xstore_point_of_service
- communications_cloud_native_core_automated_test_suite
- business_activity_monitoring
- communications_unified_inventory_management
netapp
- snapmanager
fedoraproject
- fedora
debian
- debian_linux