XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16. References: https://github.com/x-stream/xstream/security/advisories/GHSA-qpfq-ph7r-qv6f https://x-stream.github.io/CVE-2021-21347.html
Created xstream tracking bugs for this issue: Affects: fedora-all [bug 1942631]
Statement: OpenShift Container Platform (OCP) delivers Jenkins LTS package with bundled XStream library. Due to JEP-200 [1] and JEP-228 [2] Jenkins projects, OCP Jenkins package is not affected by this flaw. [1] https://github.com/jenkinsci/jep/blob/master/jep/200/README.adoc [2] https://github.com/jenkinsci/jep/blob/master/jep/228/README.adoc#security
Marking Red Hat Jboss AMQ 6 as having a low impact, AMQ distributes affected versions of XStream, however its use in AMQ 6 is not susceptible to the vulnerability as the XStream security framework with an allowlist is in place. This vulnerability is out of security support scope for the following products: * Red Hat JBoss AMQ 6 Please refer to https://access.redhat.com/support/policy/updates/jboss_notes for more details.
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2021:1354 https://access.redhat.com/errata/RHSA-2021:1354
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2021-21347
This issue has been addressed in the following products: Red Hat Data Grid 8.2.0 Via RHSA-2021:2139 https://access.redhat.com/errata/RHSA-2021:2139
This issue has been addressed in the following products: RHPAM 7.11.0 Via RHSA-2021:2475 https://access.redhat.com/errata/RHSA-2021:2475
This issue has been addressed in the following products: RHDM 7.11.0 Via RHSA-2021:2476 https://access.redhat.com/errata/RHSA-2021:2476
This issue has been addressed in the following products: Red Hat Integration Via RHSA-2021:4767 https://access.redhat.com/errata/RHSA-2021:4767
This issue has been addressed in the following products: Red Hat Integration Via RHSA-2021:4918 https://access.redhat.com/errata/RHSA-2021:4918
This issue has been addressed in the following products: Red Hat Fuse 7.10 Via RHSA-2021:5134 https://access.redhat.com/errata/RHSA-2021:5134