CVE-2021-29505
- Source
- https://cve.org/CVERecord?id=CVE-2021-29505
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-29505.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2021-29505
- Aliases
- Downstream
DEBIAN (1)
MGASA (1)
OESA (1)
RHSA (1)
SUSE (1)
UBUNTU (1)
- Related
- Published
- 2021-05-28T21:15:08Z
- Modified
- 2026-10-09T07:03:15Z
- Severity
-
- 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- [none]
- Details
-
XStream is software for serializing Java objects to XML and back again. A vulnerability in XStream versions prior to 1.4.17 may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types is affected. The vulnerability is patched in version 1.4.17.
- Database specific
{ "unresolved_ranges": [ { "cpes": [ "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*", "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*", "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*" ], "extracted_events": [ { "introduced": "9.0" }, { "last_affected": "9.0" }, { "introduced": "10.0" }, { "last_affected": "10.0" }, { "introduced": "11.0" }, { "last_affected": "11.0" } ], "source": "CPE_STRING", "vendor_product": "debian:debian_linux" }, { "cpes": [ "cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*", "cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*", "cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*" ], "extracted_events": [ { "introduced": "33" }, { "last_affected": "33" }, { "introduced": "34" }, { "last_affected": "34" }, { "introduced": "35" }, { "last_affected": "35" } ], "source": "CPE_STRING", "vendor_product": "fedoraproject:fedora" }, { "cpes": [ "cpe:2.3:a:oracle:banking_cash_management:14.2:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:banking_cash_management:14.3:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:banking_cash_management:14.5:*:*:*:*:*:*:*" ], "extracted_events": [ { "introduced": "14.2" }, { "last_affected": "14.2" }, { "introduced": "14.3" }, { "last_affected": "14.3" }, { "introduced": "14.5" }, { "last_affected": "14.5" } ], "source": "CPE_STRING", "vendor_product": "oracle:banking_cash_management" }, { "cpes": [ "cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.2.0:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.3.0:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.5.0:*:*:*:*:*:*:*" ], "extracted_events": [ { "introduced": "14.2.0" }, { "last_affected": "14.2.0" }, { "introduced": "14.3.0" }, { "last_affected": "14.3.0" }, { "introduced": "14.5.0" }, { "last_affected": "14.5.0" } ], "source": "CPE_STRING", "vendor_product": "oracle:banking_corporate_lending_process_management" }, { "cpes": [ "cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.2.0:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.3.0:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.5.0:*:*:*:*:*:*:*" ], "extracted_events": [ { "introduced": "14.2.0" }, { "last_affected": "14.2.0" }, { "introduced": "14.3.0" }, { "last_affected": "14.3.0" }, { "introduced": "14.5.0" }, { "last_affected": "14.5.0" } ], "source": "CPE_STRING", "vendor_product": "oracle:banking_credit_facilities_process_management" }, { "cpes": [ "cpe:2.3:a:oracle:banking_supply_chain_finance:14.2.0:*:*:*:*:*:*:*" ], "extracted_events": [ { "introduced": "14.2.0" }, { "last_affected": "14.2.0" } ], "source": "CPE_STRING", "vendor_product": "oracle:banking_supply_chain_finance" }, { "cpes": [ "cpe:2.3:a:oracle:banking_trade_finance_process_management:14.5.0:*:*:*:*:*:*:*" ], "extracted_events": [ { "introduced": "14.5.0" }, { "last_affected": "14.5.0" } ], "source": "CPE_STRING", "vendor_product": "oracle:banking_trade_finance_process_management" }, { "cpes": [ "cpe:2.3:a:oracle:business_activity_monitoring:11.1.1.9.0:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:business_activity_monitoring:12.2.1.3.0:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:business_activity_monitoring:12.2.1.4.0:*:*:*:*:*:*:*" ], "extracted_events": [ { "introduced": "11.1.1.9.0" }, { "last_affected": "11.1.1.9.0" }, { "introduced": "12.2.1.3.0" }, { "last_affected": "12.2.1.3.0" }, { "introduced": "12.2.1.4.0" }, { "last_affected": "12.2.1.4.0" } ], "source": "CPE_STRING", "vendor_product": "oracle:business_activity_monitoring" }, { "cpes": [ "cpe:2.3:a:oracle:communications_brm_-_elastic_charging_engine:11.3:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:communications_brm_-_elastic_charging_engine:12.0:*:*:*:*:*:*:*" ], "extracted_events": [ { "introduced": "11.3" }, { "last_affected": "11.3" }, { "introduced": "12.0" }, { "last_affected": "12.0" } ], "source": "CPE_STRING", "vendor_product": "oracle:communications_brm_-_elastic_charging_engine" }, { "cpes": [ "cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.4:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.5:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.0:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.1:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.2:*:*:*:*:*:*:*" ], "extracted_events": [ { "introduced": "7.3.4" }, { "last_affected": "7.3.4" }, { "introduced": "7.3.5" }, { "last_affected": "7.3.5" }, { "introduced": "7.4.0" }, { "last_affected": "7.4.0" }, { "introduced": "7.4.1" }, { "last_affected": "7.4.1" }, { "introduced": "7.4.2" }, { "last_affected": "7.4.2" } ], "source": "CPE_STRING", "vendor_product": "oracle:communications_unified_inventory_management" }, { "cpes": [ "cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0.0:*:*:*:*:*:*:*" ], "extracted_events": [ { "introduced": "12.4.0.0" }, { "last_affected": "12.4.0.0" } ], "source": "CPE_STRING", "vendor_product": "oracle:enterprise_manager_ops_center" }, { "cpes": [ "cpe:2.3:a:oracle:retail_customer_insights:15.0.2:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:retail_customer_insights:16.0.2:*:*:*:*:*:*:*" ], "extracted_events": [ { "introduced": "15.0.2" }, { "last_affected": "15.0.2" }, { "introduced": "16.0.2" }, { "last_affected": "16.0.2" } ], "source": "CPE_STRING", "vendor_product": "oracle:retail_customer_insights" }, { "cpes": [ "cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0.6:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0.4:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:retail_xstore_point_of_service:18.0.3:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:retail_xstore_point_of_service:19.0.2:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:retail_xstore_point_of_service:20.0.1:*:*:*:*:*:*:*" ], "extracted_events": [ { "introduced": "16.0.6" }, { "last_affected": "16.0.6" }, { "introduced": "17.0.4" }, { "last_affected": "17.0.4" }, { "introduced": "18.0.3" }, { "last_affected": "18.0.3" }, { "introduced": "19.0.2" }, { "last_affected": "19.0.2" }, { "introduced": "20.0.1" }, { "last_affected": "20.0.1" } ], "source": "CPE_STRING", "vendor_product": "oracle:retail_xstore_point_of_service" }, { "cpes": [ "cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0:*:*:*:*:*:*:*" ], "extracted_events": [ { "introduced": "12.2.1.3.0" }, { "last_affected": "12.2.1.3.0" }, { "introduced": "12.2.1.4.0" }, { "last_affected": "12.2.1.4.0" } ], "source": "CPE_STRING", "vendor_product": "oracle:webcenter_portal" }, { "cpes": [ "cpe:2.3:a:oracle:webcenter_sites:12.2.1.3.0:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:webcenter_sites:12.2.1.4.0:*:*:*:*:*:*:*" ], "extracted_events": [ { "introduced": "12.2.1.3.0" }, { "last_affected": "12.2.1.3.0" }, { "introduced": "12.2.1.4.0" }, { "last_affected": "12.2.1.4.0" } ], "source": "CPE_STRING", "vendor_product": "oracle:webcenter_sites" } ] }- References
-
- https://lists.apache.org/thread.html/r8ee51debf7fd184b6a6b020dc31df25118b0aa612885f12fbe77f04f@%3Cdev.jmeter.apache.org%3E
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB
- https://x-stream.github.io/CVE-2021-29505.html
- https://github.com/x-stream/xstream/security/advisories/GHSA-7chv-rrw6-w6fc
- https://lists.debian.org/debian-lts-announce/2021/07/msg00004.html
- https://security.netapp.com/advisory/ntap-20210708-0007
- https://security.netapp.com/advisory/ntap-20210708-0007/
- https://www.debian.org/security/2021/dsa-5004
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://lists.apache.org/thread.html/r8ee51debf7fd184b6a6b020dc31df25118b0aa612885f12fbe77f04f%40%3Cdev.jmeter.apache.org%3E
- https://github.com/x-stream/xstream/commit/24fac82191292c6ae25f94508d28b9823f83624f
- https://github.com/x-stream/xstream/commit/f0c4a8d861b68ffc3119cfbbbd632deee624e227
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/
Affected packages
Git / github.com/x-stream/xstream
Affected ranges
- Type
- GIT
- Repo
- https://github.com/x-stream/xstream
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixedFixedFixed
- Database specific
-
Show details
{ "cpe": "cpe:2.3:a:xstream:xstream:*:*:*:*:*:*:*:*", "extracted_events": [ { "introduced": "0" }, { "fixed": "1.4.17" } ], "source": [ "CPE_RANGE", "REFERENCES" ] }
Affected versions
Other
XSTREAM_1_4_10
XSTREAM_1_4_11
XSTREAM_1_4_11_1
XSTREAM_1_4_12
XSTREAM_1_4_13
XSTREAM_1_4_14
XSTREAM_1_4_15
XSTREAM_1_4_16
XSTREAM_1_4_5
XSTREAM_1_4_9
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-29505.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"function_hash": "55529827059998388985835589218509171525",
"length": 897
},
"id": "CVE-2021-29505-01e2ea1b",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/x-stream/xstream/commit/f0c4a8d861b68ffc3119cfbbbd632deee624e227",
"target": {
"file": "xstream/src/java/com/thoughtworks/xstream/XStream.java",
"function": "setupSecurity"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"228053600362383738383378574221655207960",
"315590729455584714180717487731983745448",
"257878284676754907993801838307504860032",
"231257142268735163893318086460227527786",
"183765047426471769504861481430198288414",
"161229857215197968276439161291882057455",
"304544354710807799641371135251598970303",
"264527588790798306887948232623981151266",
"87393381625111131561526952720266719235",
"130273361020895782069120355560557146251",
"154828802101872288206305236334275778530",
"259768556357375405967654864082038448418",
"74605625453746711180847749475408939299",
"204716482209653724790252231288128673691"
],
"threshold": 0.9
},
"id": "CVE-2021-29505-734e63e4",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/x-stream/xstream/commit/f0c4a8d861b68ffc3119cfbbbd632deee624e227",
"target": {
"file": "xstream/src/java/com/thoughtworks/xstream/XStream.java"
}
}
]
vanir_signatures_modified
"2026-10-09T07:03:15Z"