CVE-2021-39153: debian debian_linux

Vulnerability summary

CVE-2021-39153 is a high (CVSS 8.5) vulnerability in debian debian_linux. EPSS estimates a 4.46% chance of exploitation in the next 30 days, higher than 91.3% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 23-08-2021
   PublishedVulnerability first disclosed.
2. 07-10-2026
   Last modifiedVulnerability information updated.

Description

XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream, if using the version out of the box with Java runtime version 14 to 8 or with JavaFX installed. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.

• CWE-434Unrestricted Upload of File with Dangerous TypeThe product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
• CWE-502Deserialization of Untrusted DataThe product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.