CVE-2021-39153: Debian Linux
High severity, CVSS 8.5. EPSS: 4.5% chance of exploitation in the next 30 days.
XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream, if using the version out of the box with Java runtime version 14 to 8 or with JavaFX installed. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.
Affected products
- Debian Debian Linux: version 9.0 only; version 10.0 only; version 11.0 only
- Fedoraproject Fedora: version 33 only; version 34 only; version 35 only
- Netapp Snapmanager: affected versions not specified
- Oracle Business Activity Monitoring: version 12.2.1.4.0 only
- Oracle Communications Billing And Revenue Management Elastic Charging Engine: version 11.3 only; version 12.0 only
- Oracle Communications Cloud Native Core Automated Test Suite: version 1.9.0 only
- Oracle Communications Cloud Native Core Binding Support Function: version 1.10.0 only
- Oracle Communications Cloud Native Core Policy: version 1.14.0 only
- Oracle Communications Unified Inventory Management: version 7.3.4 only; version 7.3.5 only; version 7.4.0 only; version 7.4.1 only; version 7.4.2 only
- Oracle Utilities Framework: version 4.2.0.2.0 only; version 4.2.0.3.0 only; version 4.3.0.1.0 only; version 4.3.0.6.0 only; version 4.4.0.0.0 only; version 4.4.0.2.0 only; …
- Oracle Utilities Testing Accelerator: version 6.0.0.1.1 only
- Oracle Webcenter Portal: version 12.2.1.3.0 only; version 12.2.1.4.0 only
- XStream XStream: before 1.4.18 (fixed in 1.4.18)
Published 2021-08-23. Last modified 2026-10-07.