x-stream · xstream
The XStream Java library for serializing objects to XML and back, in versions prior to 1.4.17, contains a deserialization code injection flaw.
XStream is software for serializing Java objects to XML and back again. A vulnerability in XStream versions prior to 1.4.17 may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types is affected. The vulnerability is patched in version 1.4.17.
Public exploit code (PoC-in-GitHub) appeared 11 days after disclosure. No confirmed exploitation is recorded.
No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
1 package in 1 ecosystem. Main package: com.thoughtworks.xstream:xstream.
Upgrade to 1.4.18 or later
Fixes this CVE and 12 other known vulnerabilities in this package (CVE-2013-7285, CVE-2019-10173, +10).
Set the version to 1.4.18 or later in your pom.xml or build.gradle.
First fixed in 1.4.17 for CVE-2021-29505.
| If you run | Upgrade to |
|---|---|
| All versions before 1.4.17 | 1.4.18first fix for this CVE: 1.4.17 |
“Up to” means the second version is the fix and is not affected.
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.