CVE-2021-29505: debian debian_linux Code Injection
CVSS: 8.8v3.1HighModified
AliasesSUSE-SU-2021:1995-1RHSA-2021:2683UBUNTU-CVE-2021-29505DEBIAN-CVE-2021-29505DLA-2704-1openSUSE-SU-2021:0911-1openSUSE-SU-2021:1995-1CGA-62vc-35vx-jfwvCGA-8q4j-2m96-hfrpCGA-g7qc-v764-f825CGA-j3mm-8w2h-8597GHSA-7chv-rrw6-w6fc
Published 28-05-2021Last modified 07-10-2026
Vulnerability summary
CVE-2021-29505 is a high (CVSS 8.8) Code Injection vulnerability in debian debian_linux. EPSS estimates a 77.23% chance of exploitation in the next 30 days, higher than 99.5% of scored vulnerabilities.
CVSS score
8.8/10
010
High · v3.1 (NVD)EPSS score
77.23%
0%100%
Critical · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 2 · Related 1Timeline
- 28-05-2021PublishedVulnerability first disclosed.
- 07-10-2026Last modifiedVulnerability information updated.
Description
XStream is software for serializing Java objects to XML and back again. A vulnerability in XStream versions prior to 1.4.17 may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types is affected. The vulnerability is patched in version 1.4.17.
CVSS metrics
8 scores · 7 sources · 2 versionsHigh 8.8Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HSources7 sources · 7.5–8.8
- CVE.orgCNA7.5HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HDiffers
- OSV · Red hatEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HDiffers
- OSV · UbuntuEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · ChainguardEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · MavenEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HDiffers
Medium 6.5Preferred score · NVD (NIST)
AV:N/AC:L/Au:S/C:P/I:P/A:PSourcesSingle source
EPSS trend
Probability
77.23%
Chance of exploitation in the next 30 days
Percentile
100%
Versus all other CVEs
30-day change
0.00 pp
From 77.23% on 18-09-2026
18-09-202618-10-2026
EPSS score77.23%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-94Improper Control of Generation of Code ('Code Injection')The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
- CWE-502Deserialization of Untrusted DataThe product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Affected systems
Oracle13 products
- banking_cash_management14.2 | 14.3 | 14.5
- banking_corporate_lending_process_management14.2.0 | 14.3.0 | 14.5.0
- banking_credit_facilities_process_management14.2.0 | 14.3.0 | 14.5.0
- banking_supply_chain_finance14.2.0
- banking_trade_finance_process_management14.5.0
Suse4 products
- xstream&distro=SUSE Linux Enterprise Module for Development Tools 15 SP2< 1.4.17-3.11.2
- xstream&distro=SUSE Linux Enterprise Module for Development Tools 15 SP3< 1.4.17-3.11.2
- xstream&distro=SUSE Manager Server Module 4.1< 1.4.17-3.11.2
- xstream&distro=SUSE Manager Server Module 4.2< 1.4.17-3.11.2
Chainguard2 products
- hadoop-fips-3.3.6All versions (No fix recorded)
- hadoop-fips-3.4.2All versions (No fix recorded)
Debian2 products
- libxstream-java< 1.4.15-3 | < 1.4.11.1-1+deb9u3
- debian_linuxEOL9.0 | 10.0 | 11.0
Opensuse2 products
- xstream&distro=openSUSE Leap 15.2< 1.4.17-lp152.2.9.1
- xstream&distro=openSUSE Leap 15.3< 1.4.17-3.11.2
Redhat2 products
- xstream< 0:1.3.1-14.el7_9
- xstream-javadoc< 0:1.3.1-14.el7_9
Com.thoughtworks.xstream1 product
- xstream< 1.4.17
Fedoraproject1 product
- fedoraEOL33 | 34 | 35
Netapp1 product
Ubuntu1 product
- libxstream-javaAll versions (No fix recorded)
X-stream1 product
- xstream< 1.4.17
Xstream1 product
- xstream< 1.4.17
12 vendors · 31 products
References
38 links- github.com/x-stream/xstream/security/advisories/GHSA-7chv-rrw6-w6fcX Refsource CONFIRMARTICLEREPORTAdvisoryWEBThird Party Advisory
- github.com/x-stream/xstream/commit/24fac82191292c6ae25f94508d28b9823f83624fX Refsource MISCFIXWEBPatchThird Party Advisory
lists.debian.org/debian-lts-announce/2021/07/msg00004.htmlX Refsource MISCAdvisoryWEBMailing ListThird Party Advisory
Show all 38 references
- www.oracle.com/security-alerts/cpuoct2021.htmlX Refsource MISCAdvisoryWEBMailing ListThird Party Advisory
- security.netapp.com/advisory/ntap-20210708-0007/X Refsource CONFIRMX TransferredAdvisoryThird Party Advisory
- lists.opensuse.org/archives/…Advisory
- lists.opensuse.org/archives/…Advisory
- github.com/x-stream/xstreamPACKAGE