XStream is software for serializing Java objects to XML and back again. A vulnerability in XStream versions prior to 1.4.17 may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types is affected. The vulnerability is patched in version 1.4.17.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-017781 advisory.

    XStream is software for serializing Java objects to XML and back again. A vulnerability in XStream     versions prior to 1.4.17 may allow a remote attacker has sufficient rights to execute commands of the host     only by manipulating the processed input stream. No user who followed the recommendation to setup     XStream's security framework with a whitelist limited to the minimal required types is affected. The     vulnerability is patched in version 1.4.17.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 7 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2021-2208:03 advisory.

    * XStream: remote command execution attack by manipulating the processed input stream (CVE-2021-29505)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - XStream is software for serializing Java objects to XML and back again. A vulnerability in XStream     versions prior to 1.4.17 may allow a remote attacker has sufficient rights to execute commands of the host     only by manipulating the processed input stream. No user who followed the recommendation to setup     XStream's security framework with a whitelist limited to the minimal required types is affected. The     vulnerability is patched in version 1.4.17. (CVE-2021-29505)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - XStream is software for serializing Java objects to XML and back again. A vulnerability in XStream
    versions prior to 1.4.17 may allow a remote attacker has sufficient rights to execute commands of the host
    only by manipulating the processed input stream. No user who followed the recommendation to setup
    XStream's security framework with a whitelist limited to the minimal required types is affected. The
    vulnerability is patched in version 1.4.17. (CVE-2021-29505)

The 12.4.0.0 versions of Enterprise Manager Ops Center installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2021 CPU advisory.

  - Vulnerability in the Enterprise Manager Ops Center product of Oracle Enterprise Manager (component: Guest     Management (XStream)). The supported version that is affected is 12.4.0.0. Easily exploitable     vulnerability allows low privileged attacker with network access via HTTP to compromise Enterprise Manager     Ops Center. Successful attacks of this vulnerability can result in takeover of Enterprise Manager Ops     Center. (CVE-2021-29505)

  - Vulnerability in the Enterprise Manager Ops Center product of Oracle Enterprise Manager Ops Center     (component: Common Core (XStream)). The supported version that is affected is 12.4.0.0. Easily exploitable     vulnerability allows low privileged attacker with network access via HTTP to compromise Enterprise Manager     Ops Center. Successful attacks of this vulnerability can result in takeover of Enterprise Manager Ops     Center. (CVE-2021-21345) 

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Atlassian Jira installed on the remote host is prior to 8.17.x < 8.18.0. It is, therefore, affected by a vulnerability as referenced in the JRASERVER-72669 advisory.

  - Vulnerable version of XStream used in Jira Server and Data Center - CVE-2021-29505 (CVE-2021-29505)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has xstream packages installed that are affected by a vulnerability:

  - XStream is software for serializing Java objects to XML and back again. A vulnerability in XStream     versions prior to 1.4.17 may allow a remote attacker has sufficient rights to execute commands of the host     only by manipulating the processed input stream. No user who followed the recommendation to setup     XStream's security framework with a whitelist limited to the minimal required types is affected. The     vulnerability is patched in version 1.4.17. (CVE-2021-29505)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has xstream packages installed that are affected by a vulnerability:

  - XStream is software for serializing Java objects to XML and back again. A vulnerability in XStream     versions prior to 1.4.17 may allow a remote attacker has sufficient rights to execute commands of the host     only by manipulating the processed input stream. No user who followed the recommendation to setup     XStream's security framework with a whitelist limited to the minimal required types is affected. The     vulnerability is patched in version 1.4.17. (CVE-2021-29505)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 10 / 11 host has a package installed that is affected by multiple vulnerabilities as referenced in the dsa-5004 advisory.

    Multiple security vulnerabilities have been discovered in XStream, a Java library to serialize objects to     XML and back again. These vulnerabilities may allow a remote attacker to load and execute arbitrary code     from a remote host only by manipulating the processed input stream. XStream itself sets up a whitelist by     default now, i.e. it blocks all classes except those types it has explicit converters for. It used to have     a blacklist by default, i.e. it tried to block all currently known critical classes of the Java runtime.
    Main reason for the blacklist were compatibility, it allowed to use newer versions of XStream as drop-in     replacement. However, this approach has failed. A growing list of security reports has proven, that a     blacklist is inherently unsafe, apart from the fact that types of 3rd libraries were not even considered.
    A blacklist scenario should be avoided in general, because it provides a false sense of security. For the     oldstable distribution (buster), these problems have been fixed in version 1.4.11.1-1+deb10u3. For the     stable distribution (bullseye), these problems have been fixed in version 1.4.15-3+deb11u1. We recommend     that you upgrade your libxstream-java packages. For the detailed security status of libxstream-java please     refer to its security tracker page at: https://security-tracker.debian.org/tracker/libxstream-java

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Oracle WebCenter Sites component of Oracle Fusion Middleware is affected by multiple vulnerabilities.

  - Component: WebCenter Sites (Terracotta Quartz Scheduler)). The supported   versions that are affected are 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable   vulnerability allows unauthenticated attacker with network access via HTTP to   compromise Oracle WebCenter Sites. Successful attacks of this vulnerability   can result in takeover of Oracle WebCenter Sites. (CVE-2019-13990)

  - Component: WebCenter Sites (XStream)). The supported versions that are   affected are 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability   allows low privileged attacker with network access via HTTP to compromise   Oracle WebCenter Sites. Successful attacks of this vulnerability can result   in takeover of Oracle WebCenter Sites. (CVE-2021-29505)

  - Component: WebCenter Sites (dojo)). The supported versions that are   affected are 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability   allows unauthenticated attacker with network access via HTTP to compromise   Oracle WebCenter Sites. Successful attacks of this vulnerability can result   in unauthorized creation, deletion or modification access to critical data or   all Oracle WebCenter Sites accessible data. (CVE-2020-5258)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version

The version of Oracle WebCenter Portal installed on the remote host is missing a security patch from the October 2021 Critical Patch Update (CPU). It is, therefore, affected by a vulnerability in the Discussion Forums (XStream) component that is easily exploitable by a remote, low privileged attacker to compromise Oracle WebCenter Portal's confidentiality, integrity and availability.

Note that Nessus has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

The version of xstream installed on the remote host is prior to 1.3.1-14. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1698 advisory.

    A flaw was found in XStream. By manipulating the processed input stream, a remote attacker may be able to     obtain sufficient rights to execute commands. The highest threat from this vulnerability is to data     confidentiality and integrity as well as system availability. (CVE-2021-29505)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE-SU-2021:1995-1 advisory.

  - XStream is software for serializing Java objects to XML and back again. A vulnerability in XStream     versions prior to 1.4.17 may allow a remote attacker has sufficient rights to execute commands of the host     only by manipulating the processed input stream. No user who followed the recommendation to setup     XStream's security framework with a whitelist limited to the minimal required types is affected. The     vulnerability is patched in version 1.4.17. (CVE-2021-29505)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:2683 advisory.

  - XStream is software for serializing Java objects to XML and back again. A vulnerability in XStream     versions prior to 1.4.17 may allow a remote attacker has sufficient rights to execute commands of the host     only by manipulating the processed input stream. No user who followed the recommendation to setup     XStream's security framework with a whitelist limited to the minimal required types is affected. The     vulnerability is patched in version 1.4.17. (CVE-2021-29505)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2021-2683 advisory.

    [1.3.1-14]
    - Fix remote code execution vulnerability
    - Resolves: CVE-2021-29505

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Scientific Linux 7 host has packages installed that are affected by a vulnerability as referenced in the SLSA-2021:2683-1 advisory.

  - XStream: remote command execution attack by manipulating the processed input stream (CVE-2021-29505)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:2683 advisory.

    XStream is a Java XML serialization library to serialize objects to and deserialize object from XML.

    Security Fix(es):

    * XStream: remote command execution attack by manipulating the processed input stream (CVE-2021-29505)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 9 host has a package installed that is affected by a vulnerability as referenced in the dla-2704 advisory.

    A vulnerability in XStream, a Java library to serialize objects to and from XML, may allow a remote     attacker to execute commands of the host only by manipulating the processed input stream. Note: the     XStream project recommends to setup its security framework with a whitelist limited to the minimal     required types, rather than relying on the black list (which got updated to address this vulnerability).
    The project is also phasing out maintainance of the black list, see     https://x-stream.github.io/security.html . For Debian 9 stretch, this problem has been fixed in version     1.4.11.1-1+deb9u3. We recommend that you upgrade your libxstream-java packages. For the detailed security     status of libxstream-java please refer to its security tracker page at: https://security-     tracker.debian.org/tracker/libxstream-java Further information about Debian LTS security advisories, how     to apply these updates to your system and frequently asked questions can be found at:
    https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE-SU-2021:0911-1 advisory.

  - XStream is software for serializing Java objects to XML and back again. A vulnerability in XStream     versions prior to 1.4.17 may allow a remote attacker has sufficient rights to execute commands of the host     only by manipulating the processed input stream. No user who followed the recommendation to setup     XStream's security framework with a whitelist limited to the minimal required types is affected. The     vulnerability is patched in version 1.4.17. (CVE-2021-29505)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLES15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2021:1995-1 advisory.

    Upgrade to 1.4.17

    - CVE-2021-29505: Fixed potential code execution when unmarshalling with XStream instances       using an uninitialized security framework (bsc#1186651)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
314143	Unity Linux 20.1070e Security Update: xstream (UTSA-2026-017781)	Nessus	Unity Linux Local Security Checks	Local	high
294488	MiracleLinux 7 : xstream-1.3.1-14.el7 (AXSA:2021-2208:03)	Nessus	Miracle Linux Local Security Checks	Local	high
257158	Linux Distros Unpatched Vulnerability : CVE-2021-29505	Nessus	Misc.	Local	high
411997	SCA: security update for com.thoughtworks.xstream:xstream (GHSA-7chv-rrw6-w6fc)	Tenable Cloud Security	SCA Checks	Local	high
411997	SCA: security update for com.thoughtworks.xstream:xstream (GHSA-7chv-rrw6-w6fc)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
170201	Oracle Enterprise Manager Ops Center UI and Other Patches (Oct 2021 CPU)	Nessus	Misc.	Local	critical
162748	Atlassian Jira 8.17.x < 8.18.0 (JRASERVER-72669)	Nessus	CGI abuses	Combined	high
160824	NewStart CGSL CORE 5.05 / MAIN 5.05 : xstream Vulnerability (NS-SA-2022-0045)	Nessus	NewStart CGSL Local Security Checks	Local	high
160764	NewStart CGSL CORE 5.04 / MAIN 5.04 : xstream Vulnerability (NS-SA-2022-0007)	Nessus	NewStart CGSL Local Security Checks	Local	high
155294	Debian DSA-5004-1 : libxstream-java - security update	Nessus	Debian Local Security Checks	Local	critical
154418	Oracle WebCenter Sites Multiple Vulnerabilities (Oct 2021 CPU)	Nessus	Windows	Local	critical
154326	Oracle WebCenter Portal RCE (Oct 2021 CPU)	Nessus	Misc.	Local	high
152234	Amazon Linux 2 : xstream (ALAS-2021-1698)	Nessus	Amazon Linux Local Security Checks	Local	high
151711	openSUSE 15 Security Update : xstream (openSUSE-SU-2021:1995-1)	Nessus	SuSE Local Security Checks	Local	high
151614	CentOS 7 : xstream (RHSA-2021:2683)	Nessus	CentOS Local Security Checks	Local	high
151505	Oracle Linux 7 : xstream (ELSA-2021-2683)	Nessus	Oracle Linux Local Security Checks	Local	high
151503	Scientific Linux Security Update : xstream on SL7.x (noarch) (2021:2683)	Nessus	Scientific Linux Local Security Checks	Local	high
151493	RHEL 7 : xstream (RHSA-2021:2683)	Nessus	Red Hat Local Security Checks	Local	high
151373	Debian DLA-2704-1 : libxstream-java - LTS security update	Nessus	Debian Local Security Checks	Local	high
151061	openSUSE 15 Security Update : xstream (openSUSE-SU-2021:0911-1)	Nessus	SuSE Local Security Checks	Local	high
150898	SUSE SLED15 / SLES15 Security Update : xstream (SUSE-SU-2021:1995-1)	Nessus	SuSE Local Security Checks	Local	high

Detections

Analytics

CVE-2021-29505

high

Tenable Plugins

high

high

high

high

high

critical

high

high

high

critical

critical

high

high

high

high

high

high

high

high

high

high