CVE-2021-39140

Deserialization of Untrusted Data in maven/com.thoughtworks.xstream/xstream

Identifier

CVE-2021-39140

Package Slug

maven/com.thoughtworks.xstream/xstream

Vulnerability

Deserialization of Untrusted Data

Description

XStream is a simple library to serialize objects to XML and back again. This vulnerability may allow a remote attacker to allocate % CPU time on the target system depending on CPU type or parallel execution of such a payload resulting in a denial of service only by manipulating the processed input stream. Users who followed the recommendation to setup XStream's security framework with an allow list limited to the minimal required types are not impacted.

Affected Versions

All versions before 1.4.18

Solution

Upgrade to version 1.4.18 or above.

Last Modified

2021-09-02

source