Several security vulnerabilities were discovered in XStream, a Java library to serialize objects to XML and back again.

CVE-2020-26258

XStream is vulnerable to a Server-Side Forgery Request which can be activated when unmarshalling. The vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream.

CVE-2020-26259

Xstream is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling. The vulnerability may allow a remote attacker to delete arbitrary known files on the host as long as the executing process has sufficient rights only by manipulating the processed input stream.

For Debian 9 stretch, these problems have been fixed in version 1.4.11.1-1+deb9u1.

We recommend that you upgrade your libxstream-java packages.

For the detailed security status of libxstream-java please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/libxstream-java

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 18.04 LTS / 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4714-1 advisory.

  - XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote     attacker to run arbitrary shell commands only by manipulating the processed input stream. Only users who     rely on blocklists are affected. Anyone using XStream's Security Framework allowlist is not affected. The     linked advisory provides code workarounds for users who cannot upgrade. The issue is fixed in version     1.4.14. (CVE-2020-26217)

  - XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, a     Server-Side Forgery Request vulnerability can be activated when unmarshalling. The vulnerability may allow     a remote attacker to request data from internal resources that are not publicly available only by     manipulating the processed input stream. If you rely on XStream's default blacklist of the Security     Framework, you will have to use at least version 1.4.15. The reported vulnerability does not exist if     running Java 15 or higher. No user is affected who followed the recommendation to setup XStream's Security     Framework with a whitelist! Anyone relying on XStream's default blacklist can immediately switch to a     whilelist for the allowed types to avoid the vulnerability. Users of XStream 1.4.14 or below who still     want to use XStream default blacklist can use a workaround described in more detailed in the referenced     advisories. (CVE-2020-26258)

  - XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, is     vulnerable to an Arbitrary File Deletion on the local host when unmarshalling. The vulnerability may allow     a remote attacker to delete arbitrary know files on the host as log as the executing process has     sufficient rights only by manipulating the processed input stream. If you rely on XStream's default     blacklist of the Security Framework, you will have to use at least version 1.4.15. The reported     vulnerability does not exist running Java 15 or higher. No user is affected, who followed the     recommendation to setup XStream's Security Framework with a whitelist! Anyone relying on XStream's default     blacklist can immediately switch to a whilelist for the allowed types to avoid the vulnerability. Users of     XStream 1.4.14 or below who still want to use XStream default blacklist can use a workaround described in     more detailed in the referenced advisories. (CVE-2020-26259)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Liaogui Zhong discovered two security issues in XStream, a Java library to serialise objects to XML and back again, which could result in the deletion of files or server-side request forgery when unmarshalling.

The remote Ubuntu 18.04 LTS / 20.04 LTS / 20.10 / 21.04 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4943-1 advisory.

  - XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote     attacker to run arbitrary shell commands only by manipulating the processed input stream. Only users who     rely on blocklists are affected. Anyone using XStream's Security Framework allowlist is not affected. The     linked advisory provides code workarounds for users who cannot upgrade. The issue is fixed in version     1.4.14. (CVE-2020-26217)

  - XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, a     Server-Side Forgery Request vulnerability can be activated when unmarshalling. The vulnerability may allow     a remote attacker to request data from internal resources that are not publicly available only by     manipulating the processed input stream. If you rely on XStream's default blacklist of the Security     Framework, you will have to use at least version 1.4.15. The reported vulnerability does not exist if     running Java 15 or higher. No user is affected who followed the recommendation to setup XStream's Security     Framework with a whitelist! Anyone relying on XStream's default blacklist can immediately switch to a     whilelist for the allowed types to avoid the vulnerability. Users of XStream 1.4.14 or below who still     want to use XStream default blacklist can use a workaround described in more detailed in the referenced     advisories. (CVE-2020-26258)

  - XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, is     vulnerable to an Arbitrary File Deletion on the local host when unmarshalling. The vulnerability may allow     a remote attacker to delete arbitrary know files on the host as log as the executing process has     sufficient rights only by manipulating the processed input stream. If you rely on XStream's default     blacklist of the Security Framework, you will have to use at least version 1.4.15. The reported     vulnerability does not exist running Java 15 or higher. No user is affected, who followed the     recommendation to setup XStream's Security Framework with a whitelist! Anyone relying on XStream's default     blacklist can immediately switch to a whilelist for the allowed types to avoid the vulnerability. Users of     XStream 1.4.14 or below who still want to use XStream default blacklist can use a workaround described in     more detailed in the referenced advisories. (CVE-2020-26259)

  - XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16,     there is vulnerability which may allow a remote attacker to allocate 100% CPU time on the target system     depending on CPU type or parallel execution of such a payload resulting in a denial of service only by     manipulating the processed input stream. No user is affected who followed the recommendation to setup     XStream's security framework with a whitelist limited to the minimal required types. If you rely on     XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.
    (CVE-2021-21341)

  - XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16,     there is a vulnerability where the processed stream at unmarshalling time contains type information to     recreate the formerly written objects. XStream creates therefore new instances based on these type     information. An attacker can manipulate the processed input stream and replace or inject objects, that     result in a server-side forgery request. No user is affected, who followed the recommendation to setup     XStream's security framework with a whitelist limited to the minimal required types. If you rely on     XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.
    (CVE-2021-21342)

  - XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16,     there is a vulnerability where the processed stream at unmarshalling time contains type information to     recreate the formerly written objects. XStream creates therefore new instances based on these type     information. An attacker can manipulate the processed input stream and replace or inject objects, that     result in the deletion of a file on the local host. No user is affected, who followed the recommendation     to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely     on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.
    (CVE-2021-21343)

  - XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16,     there is a vulnerability which may allow a remote attacker to load and execute arbitrary code from a     remote host only by manipulating the processed input stream. No user is affected, who followed the     recommendation to setup XStream's security framework with a whitelist limited to the minimal required     types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least     version 1.4.16. (CVE-2021-21344, CVE-2021-21346, CVE-2021-21347)

  - XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16,     there is a vulnerability which may allow a remote attacker who has sufficient rights to execute commands     of the host only by manipulating the processed input stream. No user is affected, who followed the     recommendation to setup XStream's security framework with a whitelist limited to the minimal required     types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least     version 1.4.16. (CVE-2021-21345)

  - XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16,     there is a vulnerability which may allow a remote attacker to occupy a thread that consumes maximum CPU     time and will never return. No user is affected, who followed the recommendation to setup XStream's     security framework with a whitelist limited to the minimal required types. If you rely on XStream's     default blacklist of the Security Framework, you will have to use at least version 1.4.16.
    (CVE-2021-21348)

  - XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16,     there is a vulnerability which may allow a remote attacker to request data from internal resources that     are not publicly available only by manipulating the processed input stream. No user is affected, who     followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal     required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use     at least version 1.4.16. (CVE-2021-21349)

  - XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16,     there is a vulnerability which may allow a remote attacker to execute arbitrary code only by manipulating     the processed input stream. No user is affected, who followed the recommendation to setup XStream's     security framework with a whitelist limited to the minimal required types. If you rely on XStream's     default blacklist of the Security Framework, you will have to use at least version 1.4.16.
    (CVE-2021-21350)

  - XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16,     there is a vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host     only by manipulating the processed input stream. No user is affected, who followed the recommendation to     setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on     XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.
    (CVE-2021-21351)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for xstream fixes the following issues :

xstream was updated to version 1.4.15.

  - CVE-2020-26217: Fixed a remote code execution due to     insecure XML deserialization when relying on blocklists     (bsc#1180994).

  - CVE-2020-26258: Fixed a server-side request forgery     vulnerability (bsc#1180146).

  - CVE-2020-26259: Fixed an arbitrary file deletion     vulnerability (bsc#1180145).

This update was imported from the SUSE:SLE-15-SP2:Update update project.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - XStream: allow a remote attacker to load and execute arbitrary code from a remote host only by     manipulating the processed input stream (CVE-2021-21351)

  - XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, a     Server-Side Forgery Request vulnerability can be activated when unmarshalling. The vulnerability may allow     a remote attacker to request data from internal resources that are not publicly available only by     manipulating the processed input stream. If you rely on XStream's default blacklist of the Security     Framework, you will have to use at least version 1.4.15. The reported vulnerability does not exist if     running Java 15 or higher. No user is affected who followed the recommendation to setup XStream's Security     Framework with a whitelist! Anyone relying on XStream's default blacklist can immediately switch to a     whilelist for the allowed types to avoid the vulnerability. Users of XStream 1.4.14 or below who still     want to use XStream default blacklist can use a workaround described in more detailed in the referenced     advisories. (CVE-2020-26258)

  - XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, is     vulnerable to an Arbitrary File Deletion on the local host when unmarshalling. The vulnerability may allow     a remote attacker to delete arbitrary know files on the host as log as the executing process has     sufficient rights only by manipulating the processed input stream. If you rely on XStream's default     blacklist of the Security Framework, you will have to use at least version 1.4.15. The reported     vulnerability does not exist running Java 15 or higher. No user is affected, who followed the     recommendation to setup XStream's Security Framework with a whitelist! Anyone relying on XStream's default     blacklist can immediately switch to a whilelist for the allowed types to avoid the vulnerability. Users of     XStream 1.4.14 or below who still want to use XStream default blacklist can use a workaround described in     more detailed in the referenced advisories. (CVE-2020-26259)

  - XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16,     there is vulnerability which may allow a remote attacker to allocate 100% CPU time on the target system     depending on CPU type or parallel execution of such a payload resulting in a denial of service only by     manipulating the processed input stream. No user is affected who followed the recommendation to setup     XStream's security framework with a whitelist limited to the minimal required types. If you rely on     XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.
    (CVE-2021-21341)

  - XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16,     there is a vulnerability where the processed stream at unmarshalling time contains type information to     recreate the formerly written objects. XStream creates therefore new instances based on these type     information. An attacker can manipulate the processed input stream and replace or inject objects, that     result in a server-side forgery request. No user is affected, who followed the recommendation to setup     XStream's security framework with a whitelist limited to the minimal required types. If you rely on     XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.
    (CVE-2021-21342)

  - XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16,     there is a vulnerability where the processed stream at unmarshalling time contains type information to     recreate the formerly written objects. XStream creates therefore new instances based on these type     information. An attacker can manipulate the processed input stream and replace or inject objects, that     result in the deletion of a file on the local host. No user is affected, who followed the recommendation     to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely     on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.
    (CVE-2021-21343)

  - XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16,     there is a vulnerability which may allow a remote attacker to occupy a thread that consumes maximum CPU     time and will never return. No user is affected, who followed the recommendation to setup XStream's     security framework with a whitelist limited to the minimal required types. If you rely on XStream's     default blacklist of the Security Framework, you will have to use at least version 1.4.16.
    (CVE-2021-21348)

  - XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16,     there is a vulnerability which may allow a remote attacker to request data from internal resources that     are not publicly available only by manipulating the processed input stream. No user is affected, who     followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal     required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use     at least version 1.4.16. (CVE-2021-21349)

  - XStream is an open source java library to serialize objects to XML and back again. Versions prior to     1.4.19 may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or     parallel execution of such a payload resulting in a denial of service only by manipulating the processed     input stream. XStream 1.4.19 monitors and accumulates the time it takes to add elements to collections and     throws an exception if a set threshold is exceeded. Users are advised to upgrade as soon as possible.
    Users unable to upgrade may set the NO_REFERENCE mode to prevent recursion. See GHSA-rmr5-cpv2-vgjf for     further details on a workaround if an upgrade is not possible. (CVE-2021-43859)

  - Those using Xstream to seralize XML data may be vulnerable to Denial of Service attacks (DOS). If the     parser is running on user supplied input, an attacker may supply content that causes the parser to crash     by stackoverflow. This effect may support a denial of service attack. (CVE-2022-40151)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

ID	Name	Product	Family	Published	Updated	Severity
144681	Debian DLA-2507-1 : libxstream-java security update	Nessus	Debian Local Security Checks	1/4/2021	1/31/2024	high
145542	Ubuntu 18.04 LTS / 20.04 LTS : XStream vulnerabilities (USN-4714-1)	Nessus	Ubuntu Local Security Checks	1/29/2021	10/21/2023	high
144818	Debian DSA-4828-1 : libxstream-java - security update	Nessus	Debian Local Security Checks	1/11/2021	1/30/2024	high
149408	Ubuntu 18.04 LTS / 20.04 LTS : XStream vulnerabilities (USN-4943-1)	Nessus	Ubuntu Local Security Checks	5/12/2021	10/20/2023	critical
145314	openSUSE Security Update : xstream (openSUSE-2021-140)	Nessus	SuSE Local Security Checks	1/25/2021	1/26/2024	high
196408	RHEL 7 : xstream (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	5/11/2024	5/11/2024	critical

Detections

Analytics

Plugins Search

high

high

high

critical

high

critical