CVE-2021-29505 (CNNVD-202105-1981)
HIGH
中文标题:
XStream 代码问题漏洞
英文标题:
XStream is vulnerable to a Remote Command Execution attack
CVSS分数:
7.5
发布时间:
2021-05-28 21:00:19
漏洞类型:
代码问题
状态:
PUBLISHED
数据质量分数:
0.30
数据版本:
v3
漏洞描述
中文描述:
XStream是XStream（Xstream）团队的一个轻量级的、简单易用的开源Java类库，它主要用于将对象序列化成XML（JSON）或反序列化为对象。 XStream存在代码问题漏洞，该漏洞允许远程攻击者有足够的权限仅通过操纵处理后的输入流来执行主机的命令。
英文描述:
XStream is software for serializing Java objects to XML and back again. A vulnerability in XStream versions prior to 1.4.17 may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types is affected. The vulnerability is patched in version 1.4.17.
CWE类型:
CWE-94
CWE-502
标签:
（暂无数据）
受影响产品
| 厂商 | 产品 | 版本 | 版本范围 | 平台 | CPE |
|---|---|---|---|---|---|
| x-stream | xstream | < 1.4.17 | - | - |
cpe:2.3:a:x-stream:xstream:<_1.4.17:*:*:*:*:*:*:*
|
| xstream | xstream | * | - | - |
cpe:2.3:a:xstream:xstream:*:*:*:*:*:*:*:*
|
| debian | debian_linux | 9.0 | - | - |
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
|
| debian | debian_linux | 10.0 | - | - |
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
|
| debian | debian_linux | 11.0 | - | - |
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
|
| fedoraproject | fedora | 33 | - | - |
cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*
|
| fedoraproject | fedora | 34 | - | - |
cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
|
| fedoraproject | fedora | 35 | - | - |
cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
|
| netapp | snapmanager | - | - | - |
cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:oracle:*:*
|
| oracle | banking_cash_management | 14.2 | - | - |
cpe:2.3:a:oracle:banking_cash_management:14.2:*:*:*:*:*:*:*
|
| oracle | banking_cash_management | 14.3 | - | - |
cpe:2.3:a:oracle:banking_cash_management:14.3:*:*:*:*:*:*:*
|
| oracle | banking_cash_management | 14.5 | - | - |
cpe:2.3:a:oracle:banking_cash_management:14.5:*:*:*:*:*:*:*
|
| oracle | banking_corporate_lending_process_management | 14.2.0 | - | - |
cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.2.0:*:*:*:*:*:*:*
|
| oracle | banking_corporate_lending_process_management | 14.3.0 | - | - |
cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.3.0:*:*:*:*:*:*:*
|
| oracle | banking_corporate_lending_process_management | 14.5.0 | - | - |
cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.5.0:*:*:*:*:*:*:*
|
| oracle | banking_credit_facilities_process_management | 14.2.0 | - | - |
cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.2.0:*:*:*:*:*:*:*
|
| oracle | banking_credit_facilities_process_management | 14.3.0 | - | - |
cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.3.0:*:*:*:*:*:*:*
|
| oracle | banking_credit_facilities_process_management | 14.5.0 | - | - |
cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.5.0:*:*:*:*:*:*:*
|
| oracle | banking_supply_chain_finance | 14.2.0 | - | - |
cpe:2.3:a:oracle:banking_supply_chain_finance:14.2.0:*:*:*:*:*:*:*
|
| oracle | banking_trade_finance_process_management | 14.5.0 | - | - |
cpe:2.3:a:oracle:banking_trade_finance_process_management:14.5.0:*:*:*:*:*:*:*
|
| oracle | business_activity_monitoring | 11.1.1.9.0 | - | - |
cpe:2.3:a:oracle:business_activity_monitoring:11.1.1.9.0:*:*:*:*:*:*:*
|
| oracle | business_activity_monitoring | 12.2.1.3.0 | - | - |
cpe:2.3:a:oracle:business_activity_monitoring:12.2.1.3.0:*:*:*:*:*:*:*
|
| oracle | business_activity_monitoring | 12.2.1.4.0 | - | - |
cpe:2.3:a:oracle:business_activity_monitoring:12.2.1.4.0:*:*:*:*:*:*:*
|
| oracle | communications_brm_-_elastic_charging_engine | 11.3 | - | - |
cpe:2.3:a:oracle:communications_brm_-_elastic_charging_engine:11.3:*:*:*:*:*:*:*
|
| oracle | communications_brm_-_elastic_charging_engine | 12.0 | - | - |
cpe:2.3:a:oracle:communications_brm_-_elastic_charging_engine:12.0:*:*:*:*:*:*:*
|
| oracle | communications_unified_inventory_management | 7.3.4 | - | - |
cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.4:*:*:*:*:*:*:*
|
| oracle | communications_unified_inventory_management | 7.3.5 | - | - |
cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.5:*:*:*:*:*:*:*
|
| oracle | communications_unified_inventory_management | 7.4.0 | - | - |
cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.0:*:*:*:*:*:*:*
|
| oracle | communications_unified_inventory_management | 7.4.1 | - | - |
cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.1:*:*:*:*:*:*:*
|
| oracle | communications_unified_inventory_management | 7.4.2 | - | - |
cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.2:*:*:*:*:*:*:*
|
| oracle | enterprise_manager_ops_center | 12.4.0.0 | - | - |
cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0.0:*:*:*:*:*:*:*
|
| oracle | retail_customer_insights | 15.0.2 | - | - |
cpe:2.3:a:oracle:retail_customer_insights:15.0.2:*:*:*:*:*:*:*
|
| oracle | retail_customer_insights | 16.0.2 | - | - |
cpe:2.3:a:oracle:retail_customer_insights:16.0.2:*:*:*:*:*:*:*
|
| oracle | retail_xstore_point_of_service | 16.0.6 | - | - |
cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0.6:*:*:*:*:*:*:*
|
| oracle | retail_xstore_point_of_service | 17.0.4 | - | - |
cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0.4:*:*:*:*:*:*:*
|
| oracle | retail_xstore_point_of_service | 18.0.3 | - | - |
cpe:2.3:a:oracle:retail_xstore_point_of_service:18.0.3:*:*:*:*:*:*:*
|
| oracle | retail_xstore_point_of_service | 19.0.2 | - | - |
cpe:2.3:a:oracle:retail_xstore_point_of_service:19.0.2:*:*:*:*:*:*:*
|
| oracle | retail_xstore_point_of_service | 20.0.1 | - | - |
cpe:2.3:a:oracle:retail_xstore_point_of_service:20.0.1:*:*:*:*:*:*:*
|
| oracle | webcenter_portal | 12.2.1.3.0 | - | - |
cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:*
|
| oracle | webcenter_portal | 12.2.1.4.0 | - | - |
cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0:*:*:*:*:*:*:*
|
| oracle | webcenter_sites | 12.2.1.3.0 | - | - |
cpe:2.3:a:oracle:webcenter_sites:12.2.1.3.0:*:*:*:*:*:*:*
|
| oracle | webcenter_sites | 12.2.1.4.0 | - | - |
cpe:2.3:a:oracle:webcenter_sites:12.2.1.4.0:*:*:*:*:*:*:*
|
解决方案
中文解决方案:
（暂无数据）
英文解决方案:
（暂无数据）
临时解决方案:
（暂无数据）
参考链接
https://github.com/x-stream/xstream/security/advisories/GHSA-7chv-rrw6-w6fc
x_refsource_CONFIRM
cve.org
访问
cve.org
https://github.com/x-stream/xstream/commit/24fac82191292c6ae25f94508d28b9823f83624f
x_refsource_MISC
cve.org
访问
cve.org
https://github.com/x-stream/xstream/commit/f0c4a8d861b68ffc3119cfbbbd632deee624e227
x_refsource_MISC
cve.org
访问
cve.org
https://lists.apache.org/thread.html/r8ee51debf7fd184b6a6b020dc31df25118b0aa612885f12fbe77f04f@%3Cdev.jmeter.apache.org%3E
x_refsource_MISC
cve.org
访问
cve.org
https://lists.debian.org/debian-lts-announce/2021/07/msg00004.html
x_refsource_MISC
cve.org
访问
cve.org
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP
x_refsource_MISC
cve.org
访问
cve.org
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7
x_refsource_MISC
cve.org
访问
cve.org
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB
x_refsource_MISC
cve.org
访问
cve.org
https://security.netapp.com/advisory/ntap-20210708-0007
x_refsource_MISC
cve.org
访问
cve.org
https://www.debian.org/security/2021/dsa-5004
x_refsource_MISC
cve.org
访问
cve.org
https://www.oracle.com/security-alerts/cpuapr2022.html
x_refsource_MISC
cve.org
访问
cve.org
https://www.oracle.com/security-alerts/cpujan2022.html
x_refsource_MISC
cve.org
访问
cve.org
https://www.oracle.com/security-alerts/cpujul2022.html
x_refsource_MISC
cve.org
访问
cve.org
https://www.oracle.com/security-alerts/cpuoct2021.html
x_refsource_MISC
cve.org
访问
cve.org
https://x-stream.github.io/CVE-2021-29505.html
x_refsource_MISC
cve.org
访问
cve.org
af854a3a-2127-422b-91ae-364da2661108
OTHER
nvd.nist.gov
访问
nvd.nist.gov
af854a3a-2127-422b-91ae-364da2661108
OTHER
nvd.nist.gov
访问
nvd.nist.gov
af854a3a-2127-422b-91ae-364da2661108
OTHER
nvd.nist.gov
访问
nvd.nist.gov
af854a3a-2127-422b-91ae-364da2661108
OTHER
nvd.nist.gov
访问
nvd.nist.gov
af854a3a-2127-422b-91ae-364da2661108
OTHER
nvd.nist.gov
访问
nvd.nist.gov
CVSS评分详情
3.1 (cna)
HIGH
7.5
CVSS向量:
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
机密性
HIGH
完整性
HIGH
可用性
HIGH
时间信息
发布时间:
2021-05-28 21:00:19
修改时间:
2025-05-29 23:30:31
创建时间:
2025-11-11 15:36:48
更新时间:
2025-11-11 15:56:44
利用信息
暂无可利用代码信息
数据源详情
| 数据源 | 记录ID | 版本 | 提取时间 |
|---|---|---|---|
| CVE | cve_CVE-2021-29505 |
2025-11-11 15:20:55 | 2025-11-11 07:36:48 |
| NVD | nvd_CVE-2021-29505 |
2025-11-11 14:57:37 | 2025-11-11 07:45:07 |
| CNNVD | cnnvd_CNNVD-202105-1981 |
2025-11-11 15:10:39 | 2025-11-11 07:56:44 |
版本与语言
当前版本:
v3
主要语言:
EN
支持语言:
EN
ZH
安全公告
暂无安全公告信息
变更历史
v3
CNNVD
2025-11-11 15:56:44
vulnerability_type: 未提取 → 代码问题; cnnvd_id: 未提取 → CNNVD-202105-1981; data_sources: ['cve', 'nvd'] → ['cnnvd', 'cve', 'nvd']
查看详细变更
- vulnerability_type: 未提取 -> 代码问题
- cnnvd_id: 未提取 -> CNNVD-202105-1981
- data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
v2
NVD
2025-11-11 15:45:07
affected_products_count: 1 → 42; references_count: 15 → 20; data_sources: ['cve'] → ['cve', 'nvd']
查看详细变更
- affected_products_count: 1 -> 42
- references_count: 15 -> 20
- data_sources: ['cve'] -> ['cve', 'nvd']