The remote Scientific Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the SLSA-2021:3956-1 advisory.

  - xstream: Arbitrary code execution via unsafe deserialization of Xalan xsltc.trax.TemplatesImpl     (CVE-2021-39139, CVE-2021-39153)

  - xstream: Arbitrary code execution via unsafe deserialization of com.sun.xml.internal.ws.client.sei.*     (CVE-2021-39141)

  - xstream: Arbitrary code execution via unsafe deserialization of sun.tracing.* (CVE-2021-39144)

  - xstream: Arbitrary code execution via unsafe deserialization of com.sun.jndi.ldap.LdapBindingEnumeration     (CVE-2021-39145, CVE-2021-39151)

  - xstream: Arbitrary code execution via unsafe deserialization of javax.swing.UIDefaults$ProxyLazyValue     (CVE-2021-39146, CVE-2021-39154)

  - xstream: Arbitrary code execution via unsafe deserialization of com.sun.jndi.ldap.LdapSearchEnumeration     (CVE-2021-39147)

  - xstream: Arbitrary code execution via unsafe deserialization of com.sun.jndi.toolkit.dir.ContextEnumerator     (CVE-2021-39148)

  - xstream: Arbitrary code execution via unsafe deserialization of com.sun.corba.* (CVE-2021-39149)

  - xstream: Server-side request forgery (SSRF) via unsafe deserialization of     com.sun.xml.internal.ws.client.sei.* (CVE-2021-39150)

  - xstream: Server-side request forgery (SSRF) via unsafe deserialization of     jdk.nashorn.internal.runtime.Source$URLData (CVE-2021-39152)

  - xstream: Infinite loop DoS via unsafe deserialization of     sun.reflect.annotation.AnnotationInvocationHandler (CVE-2021-39140)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Detections

Analytics

Scientific Linux Security Update : xstream on SL7.x (noarch) (2021:3956)

high Nessus Plugin ID 154412

Version 1.6