Vulnerability Name:

CVE-2021-39144 (CCN-208112)

Assigned:2021-08-22
Published:2021-08-22
Updated:2023-06-26
Summary:XStream could allow a remote authenticated attacker to execute arbitrary commands on the system, caused by an unsafe deserialization flaw. By manipulating the processed input stream, an attacker could exploit this vulnerability to execute arbitrary commands on the system.
CVSS v3 Severity:8.5 High (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H)
7.4 High (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): High
Privileges Required (PR): Low
User Interaction (UI): None
Scope:Scope (S): Changed
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
8.5 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H)
7.4 High (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): High
Privileges Required (PR): Low
User Interaction (UI): None
Scope:Scope (S): Changed
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
8.5 High (REDHAT CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H)
7.4 High (REDHAT Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): High
Privileges Required (PR): Low
User Interaction (UI): None
Scope:Scope (S): Changed
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
CVSS v2 Severity:6.0 Medium (CVSS v2 Vector: AV:N/AC:M/Au:S/C:P/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
7.1 High (CCN CVSS v2 Vector: AV:N/AC:H/Au:S/C:C/I:C/A:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): High
Athentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2021-39144

Source: security-advisories@github.com
Type: Exploit, Third Party Advisory, VDB Entry
security-advisories@github.com

Source: XF
Type: UNKNOWN
xstream-cve202139144-cmd-exec(208112)

Source: security-advisories@github.com
Type: Vendor Advisory
security-advisories@github.com

Source: security-advisories@github.com
Type: Mailing List, Third Party Advisory
security-advisories@github.com

Source: security-advisories@github.com
Type: Mailing List, Third Party Advisory
security-advisories@github.com

Source: security-advisories@github.com
Type: Mailing List, Third Party Advisory
security-advisories@github.com

Source: security-advisories@github.com
Type: Mailing List, Third Party Advisory
security-advisories@github.com

Source: security-advisories@github.com
Type: Third Party Advisory
security-advisories@github.com

Source: security-advisories@github.com
Type: Third Party Advisory
security-advisories@github.com

Source: CCN
Type: IBM Security Bulletin 6492209 (Watson Discovery)
IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in XStream

Source: CCN
Type: IBM Security Bulletin 6525066 (Spectrum Protect Plus)
Vulnerabilities in XStream affect IBM Spectrum Protect Plus

Source: CCN
Type: IBM Security Bulletin 6525260 (Spectrum Copy Data Management)
Vulnerabilities in XStream affect IBM Spectrum Copy Data Management

Source: CCN
Type: IBM Security Bulletin 6570915 (Data Risk Manager)
IBM Data Risk Manager is affected by multiple vulnerabilities including a remote code execution in Spring Framework (CVE-2022-22965)

Source: CCN
Type: IBM Security Bulletin 6573057 (Sterling B2B Integrator)
IBM Sterling B2B Integrator is vulnerable to multiple vulnerabilities due to Xstream

Source: CCN
Type: IBM Security Bulletin 6575535 (InfoSphere Information Server)
IBM InfoSphere Information Server is affected by multiple vulnerabilities in XStream

Source: CCN
Type: IBM Security Bulletin 6590209 (Spectrum Control)
IBM Spectrum Control is vulnerable to multiple weaknesses related to XStream, Apache Xerces2, Jackson, OpenSSL, and Java SE

Source: security-advisories@github.com
Type: Patch, Third Party Advisory
security-advisories@github.com

Source: security-advisories@github.com
Type: Patch, Third Party Advisory
security-advisories@github.com

Source: security-advisories@github.com
Type: Patch, Third Party Advisory
security-advisories@github.com

Source: CCN
Type: XStream GIT Repository
CVE-2021-39144: XStream is vulnerable to a Remote Command Execution attack

Source: security-advisories@github.com
Type: Exploit, Vendor Advisory
security-advisories@github.com

Vulnerable Configuration:Configuration RedHat 1:
  • cpe:/o:redhat:enterprise_linux:7:*:*:*:*:*:*:*
    • Configuration RedHat 2:
  • cpe:/o:redhat:enterprise_linux:7::client:*:*:*:*:*
    • Configuration RedHat 3:
  • cpe:/o:redhat:enterprise_linux:7::computenode:*:*:*:*:*
    • Configuration RedHat 4:
  • cpe:/o:redhat:enterprise_linux:7::server:*:*:*:*:*
    • Configuration RedHat 5:
  • cpe:/o:redhat:enterprise_linux:7::workstation:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:xstream_project:xstream:1.4.17:*:*:*:*:*:*:*
  • AND
  • cpe:/a:ibm:infosphere_information_server:11.7:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:sterling_b2b_integrator:6.0.0.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:watson_discovery:2.0.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:sterling_b2b_integrator:6.1.0.0:*:*:*:standard:*:*:*
  • OR cpe:/a:ibm:watson_discovery:2.2.1:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:spectrum_copy_data_management:2.2.13:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:sterling_b2b_integrator:6.1.1.0:*:*:*:standard:*:*:*
  • OR cpe:/a:ibm:sterling_b2b_integrator:6.0.3.5:*:*:*:standard:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:8073
    P
    		xstream-1.4.20-150200.3.25.1 on GA media (Moderate)
    2023-06-20
    oval:org.opensuse.security:def:95413
    P
    		Security update for haproxy (Moderate)
    2022-07-06
    oval:org.opensuse.security:def:3432
    P
    		apache2-mod_jk-1.2.40-7.3.1 on GA media (Moderate)
    2022-06-28
    oval:org.opensuse.security:def:94921
    P
    		libQt5OpenGLExtensions-devel-static-5.15.2+kde294-150400.4.8 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:95062
    P
    		xstream-1.4.19-3.18.2 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:4581
    P
    		Security update for the Linux Kernel (Live Patch 22 for SLE 12 SP5) (Important)
    2022-04-23
    oval:org.opensuse.security:def:6206
    P
    		Security update for xen (Important)
    2022-03-23
    oval:org.opensuse.security:def:102126
    P
    		Security update for the Linux Kernel (Important)
    2022-03-08
    oval:org.opensuse.security:def:101634
    P
    		Security update for strongswan (Important)
    2022-02-18
    oval:org.opensuse.security:def:113607
    P
    		xstream-1.4.18-1.1 on GA media (Moderate)
    2022-01-17
    oval:org.opensuse.security:def:4512
    P
    		Security update for the Linux Kernel (Live Patch 16 for SLE 12 SP5) (Important)
    2021-11-17
    oval:org.opensuse.security:def:111101
    P
    		Security update for xstream (Important)
    2021-10-31
    oval:com.redhat.rhsa:def:20213956
    P
    		RHSA-2021:3956: xstream security update (Important)
    2021-10-25
    oval:org.opensuse.security:def:95984
    P
    		Security update for xstream (Important)
    2021-10-20
    oval:org.opensuse.security:def:76363
    P
    		Security update for xstream (Important)
    2021-10-20
    oval:org.opensuse.security:def:94190
    P
    		 (Important)
    2021-10-20
    oval:org.opensuse.security:def:100338
    P
    		 (Important)
    2021-10-20
    oval:org.opensuse.security:def:67295
    P
    		Security update for xstream (Important)
    2021-10-20
    oval:org.opensuse.security:def:74669
    P
    		Security update for xstream (Important)
    2021-10-20
    oval:org.opensuse.security:def:65601
    P
    		Security update for xstream (Important)
    2021-10-20
    oval:org.opensuse.security:def:94401
    P
    		 (Important)
    2021-10-20
    oval:org.opensuse.security:def:100667
    P
    		 (Important)
    2021-10-20
    oval:org.opensuse.security:def:74738
    P
    		Security update for xstream (Important)
    2021-10-20
    oval:org.opensuse.security:def:108300
    P
    		Security update for xstream (Important)
    2021-10-20
    oval:org.opensuse.security:def:93764
    P
    		 (Important)
    2021-10-20
    oval:org.opensuse.security:def:65670
    P
    		Security update for xstream (Important)
    2021-10-20
    oval:org.opensuse.security:def:5865
    P
    		Security update for xstream (Important)
    2021-10-20
    oval:org.opensuse.security:def:101808
    P
    		Security update for xstream (Important)
    2021-10-20
    oval:org.opensuse.security:def:76022
    P
    		Security update for xstream (Important)
    2021-10-20
    oval:org.opensuse.security:def:108792
    P
    		Security update for xstream (Important)
    2021-10-20
    oval:org.opensuse.security:def:93978
    P
    		 (Important)
    2021-10-20
    oval:org.opensuse.security:def:100002
    P
    		 (Important)
    2021-10-20
    oval:org.opensuse.security:def:66954
    P
    		Security update for xstream (Important)
    2021-10-20
    oval:org.opensuse.security:def:111754
    P
    		Security update for xstream (Important)
    2021-10-20
    oval:org.opensuse.security:def:117814
    P
    		Security update for xstream (Important)
    2021-10-20
    oval:org.opensuse.security:def:1130
    P
    		Security update for xstream (Important)
    2021-10-20
    oval:org.opensuse.security:def:106990
    P
    		xstream-1.4.18-1.1 on GA media (Moderate)
    2021-10-01
    BACK
    xstream_project xstream 1.4.17
    ibm infosphere information server 11.7
    ibm sterling b2b integrator 6.0.0.0
    ibm watson discovery 2.0.0
    ibm sterling b2b integrator 6.1.0.0
    ibm watson discovery 2.2.1
    ibm spectrum copy data management 2.2.13
    ibm sterling b2b integrator 6.1.1.0
    ibm sterling b2b integrator 6.0.3.5