CVE-2021-29505: Debian Linux

High severity, CVSS 8.8. EPSS: 77.2% chance of exploitation in the next 30 days.

XStream is software for serializing Java objects to XML and back again. A vulnerability in XStream versions prior to 1.4.17 may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types is affected. The vulnerability is patched in version 1.4.17.

Affected products

  • Debian Debian Linux: version 9.0 only; version 10.0 only; version 11.0 only
  • Fedoraproject Fedora: version 33 only; version 34 only; version 35 only
  • Netapp Snapmanager: affected versions not specified
  • Oracle Banking Cash Management: version 14.2 only; version 14.3 only; version 14.5 only
  • Oracle Banking Corporate Lending Process Management: version 14.2.0 only; version 14.3.0 only; version 14.5.0 only
  • Oracle Banking Credit Facilities Process Management: version 14.2.0 only; version 14.3.0 only; version 14.5.0 only
  • Oracle Banking Supply Chain Finance: version 14.2.0 only
  • Oracle Banking Trade Finance Process Management: version 14.5.0 only
  • Oracle Business Activity Monitoring: version 11.1.1.9.0 only; version 12.2.1.3.0 only; version 12.2.1.4.0 only
  • Oracle Communications Brm - Elastic Charging Engine: version 11.3 only; version 12.0 only
  • Oracle Communications Unified Inventory Management: version 7.3.4 only; version 7.3.5 only; version 7.4.0 only; version 7.4.1 only; version 7.4.2 only
  • Oracle Enterprise Manager Ops Center: version 12.4.0.0 only
  • Oracle Retail Customer Insights: version 15.0.2 only; version 16.0.2 only
  • Oracle Retail Xstore Point Of Service: version 16.0.6 only; version 17.0.4 only; version 18.0.3 only; version 19.0.2 only; version 20.0.1 only
  • Oracle Webcenter Portal: version 12.2.1.3.0 only; version 12.2.1.4.0 only
  • Oracle Webcenter Sites: version 12.2.1.3.0 only; version 12.2.1.4.0 only
  • XStream XStream: before 1.4.17 (fixed in 1.4.17)

Published 2021-05-28. Last modified 2026-10-07.