Vulnerability CVE-2021-43859

Vulnerability Name:

CVE-2021-43859 (CCN-219177)

Assigned:

2021-11-16

Published:

2022-01-30

Updated:

2022-08-09

Summary:

XStream is an open source java library to serialize objects to XML and back again. Versions prior to 1.4.19 may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a payload resulting in a denial of service only by manipulating the processed input stream. XStream 1.4.19 monitors and accumulates the time it takes to add elements to collections and throws an exception if a set threshold is exceeded. Users are advised to upgrade as soon as possible. Users unable to upgrade may set the NO_REFERENCE mode to prevent recursion. See GHSA-rmr5-cpv2-vgjf for further details on a workaround if an upgrade is not possible.

CVSS v3 Severity:

7.5 High (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
6.5 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): High

7.5 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
6.5 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): High

CVSS v2 Severity:

5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): Partial

7.8 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): Complete

Vulnerability Type:

CWE-400

Vulnerability Consequences:

Denial of Service

References:

Vulnerable Configuration:

Configuration 1:

cpe:/a:xstream_project:xstream:*:*:*:*:*:*:*:* (Version < 1.4.19)

Configuration 2:

cpe:/o:fedoraproject:fedora:34:*:*:*:*:*:*:*

OR cpe:/o:fedoraproject:fedora:35:*:*:*:*:*:*:*

Configuration 3:

cpe:/o:debian:debian_linux:9.0:*:*:*:*:*:*:*

Configuration 4:

cpe:/a:oracle:flexcube_private_banking:12.1.0:*:*:*:*:*:*:*

OR cpe:/a:oracle:commerce_guided_search:11.3.2:*:*:*:*:*:*:*

OR cpe:/a:oracle:retail_xstore_point_of_service:16.0.6:*:*:*:*:*:*:*

OR cpe:/a:oracle:retail_xstore_point_of_service:17.0.4:*:*:*:*:*:*:*

OR cpe:/a:oracle:retail_xstore_point_of_service:18.0.3:*:*:*:*:*:*:*

OR cpe:/a:oracle:retail_xstore_point_of_service:19.0.2:*:*:*:*:*:*:*

OR cpe:/a:oracle:retail_xstore_point_of_service:20.0.1:*:*:*:*:*:*:*

OR cpe:/a:oracle:communications_cloud_native_core_automated_test_suite:1.9.0:*:*:*:*:*:*:*

OR cpe:/a:oracle:communications_policy_management:12.6.0.0.0:*:*:*:*:*:*:*

OR cpe:/a:oracle:communications_diameter_intelligence_hub:*:*:*:*:*:*:*:* (Version >= 8.2.0 and <= 8.2.6)

OR cpe:/a:oracle:communications_diameter_intelligence_hub:*:*:*:*:*:*:*:* (Version >= 8.0.0 and <= 8.1.0)

OR cpe:/a:oracle:communications_brm_-_elastic_charging_engine:12.0.0.5.0:*:*:*:*:*:*:*

OR cpe:/a:oracle:communications_brm_-_elastic_charging_engine:*:*:*:*:*:*:*:* (Version < 12.0.0.4.6)

Configuration CCN 1:

cpe:/a:xstream_project:xstream:1.4.18:*:*:*:*:*:*:*

AND

cpe:/a:ibm:atlas_ediscovery_process_management:6.0.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_netcool_configuration_manager:6.4.2:*:*:*:*:*:*:*

OR cpe:/a:oracle:flexcube_private_banking:12.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:infosphere_information_server:11.7:*:*:*:*:*:*:*

OR cpe:/a:ibm:spectrum_protect_plus:10.1.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:qradar_security_information_and_event_manager:7.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:sterling_b2b_integrator:6.0.0.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:watson_discovery:2.0.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:qradar_security_information_and_event_manager:7.4:-:*:*:*:*:*:*

OR cpe:/a:ibm:sterling_b2b_integrator:6.1.0.0:*:*:*:standard:*:*:*

OR cpe:/a:ibm:engineering_test_management:7.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:engineering_test_management:7.0.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:watson_discovery:2.2.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:sterling_b2b_integrator:6.1.1.0:*:*:*:standard:*:*:*

OR cpe:/a:ibm:spectrum_copy_data_management:2.2.0.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:spectrum_copy_data_management:2.2.15.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:security_verify_governance:10.0:*:*:*:*:*:*:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:org.opensuse.security:def:8073	P	xstream-1.4.20-150200.3.25.1 on GA media (Moderate)	2023-06-20
oval:org.opensuse.security:def:3432	P	apache2-mod_jk-1.2.40-7.3.1 on GA media (Moderate)	2022-06-28
oval:org.opensuse.security:def:95062	P	xstream-1.4.19-3.18.2 on GA media (Moderate)	2022-06-22
oval:org.opensuse.security:def:93851	P	(Moderate)	2022-03-14
oval:org.opensuse.security:def:100096	P	(Moderate)	2022-03-14
oval:org.opensuse.security:def:102178	P	Security update for xstream (Moderate)	2022-03-14
oval:org.opensuse.security:def:94063	P	(Moderate)	2022-03-14
oval:org.opensuse.security:def:100434	P	(Moderate)	2022-03-14
oval:org.opensuse.security:def:119146	P	Security update for xstream (Moderate)	2022-03-14
oval:org.opensuse.security:def:1195	P	Security update for xstream (Moderate)	2022-03-14
oval:org.opensuse.security:def:94277	P	(Moderate)	2022-03-14
oval:org.opensuse.security:def:100768	P	(Moderate)	2022-03-14
oval:org.opensuse.security:def:94484	P	(Moderate)	2022-03-14
oval:org.opensuse.security:def:101857	P	Security update for xstream (Moderate)	2022-03-14

BACK