[Bug 1942635] New: CVE-2021-21349 XStream: SSRF can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host
11:17 a.m.
https://bugzilla.redhat.com/show_bug.cgi?id=1942635
Bug ID: 1942635
Summary: CVE-2021-21349 XStream: SSRF can be activated
unmarshalling with XStream to access data streams from
an arbitrary URL referencing a resource in an intranet
or the local host
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: gsuckevi(a)redhat.com
CC: abenaiss(a)redhat.com, aileenc(a)redhat.com,
akoufoud(a)redhat.com, alazarot(a)redhat.com,
almorale(a)redhat.com, anstephe(a)redhat.com,
aos-bugs(a)redhat.com, ataylor(a)redhat.com,
bibryam(a)redhat.com, bmontgom(a)redhat.com,
chazlett(a)redhat.com, dchen(a)redhat.com,
drieden(a)redhat.com, eparis(a)redhat.com,
etirelli(a)redhat.com, ggaughan(a)redhat.com,
gmalinko(a)redhat.com, gvarsami(a)redhat.com,
hbraun(a)redhat.com, ibek(a)redhat.com,
janstey(a)redhat.com, java-maint(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jburrell(a)redhat.com, jcoleman(a)redhat.com,
jochrist(a)redhat.com, jokerman(a)redhat.com,
jolee(a)redhat.com, jross(a)redhat.com,
jschatte(a)redhat.com, jstastny(a)redhat.com,
jwon(a)redhat.com, kaycoth(a)redhat.com,
kconner(a)redhat.com, krathod(a)redhat.com,
kverlaen(a)redhat.com, ldimaggi(a)redhat.com,
lkundrak(a)v3.sk, mizdebsk(a)redhat.com,
mnovotny(a)redhat.com, nstielau(a)redhat.com,
nwallace(a)redhat.com, pantinor(a)redhat.com,
pbhattac(a)redhat.com, pjindal(a)redhat.com,
rrajasek(a)redhat.com, rsynek(a)redhat.com,
rwagner(a)redhat.com, sdaley(a)redhat.com,
sponnaga(a)redhat.com, tcunning(a)redhat.com,
tkirby(a)redhat.com, vbobade(a)redhat.com
Target Milestone: ---
Classification: Other
XStream is a Java library to serialize objects to XML and back again. In
XStream before version 1.4.16, there is a vulnerability which may allow a
remote attacker to request data from internal resources that are not publicly
available only by manipulating the processed input stream. No user is affected,
who followed the recommendation to setup XStream's security framework with a
whitelist limited to the minimal required types. If you rely on XStream's
default blacklist of the Security Framework, you will have to use at least
version 1.4.16.
References:
https://github.com/x-stream/xstream/security/advisories/GHSA-f6hm-88x3-mfjv
https://x-stream.github.io/CVE-2021-21349.html
--
You are receiving this mail because:
You are on the CC list for the bug.
11:17 a.m.
New subject: [Bug 1942635] CVE-2021-21349 XStream: SSRF can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host
https://bugzilla.redhat.com/show_bug.cgi?id=1942635
Guilherme de Almeida Suckevicz <gsuckevi(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Depends On| |1942636
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1942636
[Bug 1942636] CVE-2021-21349 xstream: SSRF can be activated unmarshalling with
XStream to access data streams from an arbitrary URL referencing a resource in
an intranet or the local host [fedora-all]
--
You are receiving this mail because:
You are on the CC list for the bug.
11:17 a.m.
New subject: [Bug 1942635] CVE-2021-21349 XStream: SSRF can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host
https://bugzilla.redhat.com/show_bug.cgi?id=1942635
--- Comment #1 from Guilherme de Almeida Suckevicz <gsuckevi(a)redhat.com> ---
Created xstream tracking bugs for this issue:
Affects: fedora-all [bug 1942636]
--
You are receiving this mail because:
You are on the CC list for the bug.
11:26 a.m.
New subject: [Bug 1942635] CVE-2021-21349 XStream: SSRF can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host
https://bugzilla.redhat.com/show_bug.cgi?id=1942635
Guilherme de Almeida Suckevicz <gsuckevi(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Blocks| |1942645
--
You are receiving this mail because:
You are on the CC list for the bug.
2:44 p.m.
New subject: [Bug 1942635] CVE-2021-21349 XStream: SSRF can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host
https://bugzilla.redhat.com/show_bug.cgi?id=1942635
Chess Hazlett <chazlett(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Fixed In Version| |xstream 1.4.16
--
You are receiving this mail because:
You are on the CC list for the bug.
5:38 a.m.
New subject: [Bug 1942635] CVE-2021-21349 XStream: SSRF can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host
https://bugzilla.redhat.com/show_bug.cgi?id=1942635
--- Comment #2 from Przemyslaw Roguski <proguski(a)redhat.com> ---
Statement:
OpenShift Container Platform (OCP) delivers Jenkins LTS package with bundled
XStream library. Due to JEP-200 [1] and JEP-228 [2] Jenkins projects, OCP
jenkins package is not affected by this flaw.
[1] https://github.com/jenkinsci/jep/blob/master/jep/200/README.adoc
[2] https://github.com/jenkinsci/jep/blob/master/jep/228/README.adoc#security
--
You are receiving this mail because:
You are on the CC list for the bug.
10:09 a.m.
New subject: [Bug 1942635] CVE-2021-21349 XStream: SSRF can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host
https://bugzilla.redhat.com/show_bug.cgi?id=1942635
--- Comment #3 from amctagga(a)redhat.com ---
Statement:
OpenShift Container Platform (OCP) delivers Jenkins LTS package with bundled
XStream library. Due to JEP-200 [1] and JEP-228 [2] Jenkins projects, OCP
Jenkins package is not affected by this flaw.
[1] https://github.com/jenkinsci/jep/blob/master/jep/200/README.adoc
[2] https://github.com/jenkinsci/jep/blob/master/jep/228/README.adoc#security
--
You are receiving this mail because:
You are on the CC list for the bug.
7:36 p.m.
New subject: [Bug 1942635] CVE-2021-21349 XStream: SSRF can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host
https://bugzilla.redhat.com/show_bug.cgi?id=1942635
Kunjan Rathod <krathod(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Flags| |needinfo?(chazlett(a)redhat.c
| |om)
--
You are receiving this mail because:
You are on the CC list for the bug.
7:36 p.m.
New subject: [Bug 1942635] CVE-2021-21349 XStream: SSRF can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host
https://bugzilla.redhat.com/show_bug.cgi?id=1942635
Kunjan Rathod <krathod(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Flags| |needinfo?(pjindal(a)redhat.co
| |m)
--
You are receiving this mail because:
You are on the CC list for the bug.
7:37 p.m.
New subject: [Bug 1942635] CVE-2021-21349 XStream: SSRF can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host
https://bugzilla.redhat.com/show_bug.cgi?id=1942635
Kunjan Rathod <krathod(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Flags| |needinfo?(jwon(a)redhat.com)
--
You are receiving this mail because:
You are on the CC list for the bug.
7:38 p.m.
New subject: [Bug 1942635] CVE-2021-21349 XStream: SSRF can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host
https://bugzilla.redhat.com/show_bug.cgi?id=1942635
Kunjan Rathod <krathod(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Flags| |needinfo?(jochrist(a)redhat.c
| |om)
--
You are receiving this mail because:
You are on the CC list for the bug.
1:16 a.m.
New subject: [Bug 1942635] CVE-2021-21349 XStream: SSRF can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host
https://bugzilla.redhat.com/show_bug.cgi?id=1942635
Ted (Jong Seok) Won <jwon(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Flags|needinfo?(jwon(a)redhat.com) |
--
You are receiving this mail because:
You are on the CC list for the bug.
2:57 p.m.
New subject: [Bug 1942635] CVE-2021-21349 XStream: SSRF can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host
https://bugzilla.redhat.com/show_bug.cgi?id=1942635
Chess Hazlett <chazlett(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Flags|needinfo?(chazlett(a)redhat.c |
|om) |
--
You are receiving this mail because:
You are on the CC list for the bug.
7:42 a.m.
New subject: [Bug 1942635] CVE-2021-21349 XStream: SSRF can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host
https://bugzilla.redhat.com/show_bug.cgi?id=1942635
Paramvir jindal <pjindal(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Flags|needinfo?(pjindal(a)redhat.co |
|m) |
--
You are receiving this mail because:
You are on the CC list for the bug.
8:06 a.m.
New subject: [Bug 1942635] CVE-2021-21349 XStream: SSRF can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host
https://bugzilla.redhat.com/show_bug.cgi?id=1942635
Jonathan Christison <jochrist(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Flags|needinfo?(jochrist(a)redhat.c |
|om) |
--
You are receiving this mail because:
You are on the CC list for the bug.
4:50 p.m.
New subject: [Bug 1942635] CVE-2021-21349 XStream: SSRF can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host
https://bugzilla.redhat.com/show_bug.cgi?id=1942635
--- Comment #15 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> ---
This issue has been addressed in the following products:
Red Hat Data Grid 8.2.0
Via RHSA-2021:2139 https://access.redhat.com/errata/RHSA-2021:2139
--
You are receiving this mail because:
You are on the CC list for the bug.
6:32 p.m.
New subject: [Bug 1942635] CVE-2021-21349 XStream: SSRF can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host
https://bugzilla.redhat.com/show_bug.cgi?id=1942635
Product Security DevOps Team <prodsec-dev(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |CLOSED
Resolution|--- |ERRATA
Last Closed| |2021-05-26 23:32:45
--- Comment #16 from Product Security DevOps Team <prodsec-dev(a)redhat.com> ---
This bug is now closed. Further updates for individual products will be
reflected on the CVE page(s):
https://access.redhat.com/security/cve/cve-2021-21349
--
You are receiving this mail because:
You are on the CC list for the bug.
8:16 a.m.
New subject: [Bug 1942635] CVE-2021-21349 XStream: SSRF can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host
https://bugzilla.redhat.com/show_bug.cgi?id=1942635
--- Comment #17 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> ---
This issue has been addressed in the following products:
RHPAM 7.11.0
Via RHSA-2021:2475 https://access.redhat.com/errata/RHSA-2021:2475
--
You are receiving this mail because:
You are on the CC list for the bug.
8:16 a.m.
New subject: [Bug 1942635] CVE-2021-21349 XStream: SSRF can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host
https://bugzilla.redhat.com/show_bug.cgi?id=1942635
errata-xmlrpc <errata-xmlrpc(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Link ID| |Red Hat Product Errata
| |RHSA-2021:2475
--
You are receiving this mail because:
You are on the CC list for the bug.
8:20 a.m.
New subject: [Bug 1942635] CVE-2021-21349 XStream: SSRF can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host
https://bugzilla.redhat.com/show_bug.cgi?id=1942635
--- Comment #18 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> ---
This issue has been addressed in the following products:
RHDM 7.11.0
Via RHSA-2021:2476 https://access.redhat.com/errata/RHSA-2021:2476
--
You are receiving this mail because:
You are on the CC list for the bug.
8:20 a.m.
New subject: [Bug 1942635] CVE-2021-21349 XStream: SSRF can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host
https://bugzilla.redhat.com/show_bug.cgi?id=1942635
errata-xmlrpc <errata-xmlrpc(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Link ID| |Red Hat Product Errata
| |RHSA-2021:2476
--
You are receiving this mail because:
You are on the CC list for the bug.
6:39 p.m.
New subject: [Bug 1942635] CVE-2021-21349 XStream: SSRF can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host
https://bugzilla.redhat.com/show_bug.cgi?id=1942635
Bug 1942635 depends on bug 1942636, which changed state.
Bug 1942636 Summary: CVE-2021-21349 xstream: SSRF can be activated unmarshalling with
XStream to access data streams from an arbitrary URL referencing a resource in an intranet
or the local host [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1942636
What |Removed |Added
----------------------------------------------------------------------------
Status|ON_QA |CLOSED
Resolution|--- |ERRATA
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=1942635
4:35 a.m.
New subject: [Bug 1942635] CVE-2021-21349 XStream: SSRF can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host
https://bugzilla.redhat.com/show_bug.cgi?id=1942635
--- Comment #20 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> ---
This issue has been addressed in the following products:
Red Hat Integration
Via RHSA-2021:4767 https://access.redhat.com/errata/RHSA-2021:4767
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=1942635
4:35 a.m.
New subject: [Bug 1942635] CVE-2021-21349 XStream: SSRF can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host
https://bugzilla.redhat.com/show_bug.cgi?id=1942635
errata-xmlrpc <errata-xmlrpc(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Link ID| |Red Hat Product Errata
| |RHSA-2021:4767
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=1942635
3:34 p.m.
New subject: [Bug 1942635] CVE-2021-21349 XStream: SSRF can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host
https://bugzilla.redhat.com/show_bug.cgi?id=1942635
--- Comment #21 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> ---
This issue has been addressed in the following products:
Red Hat Fuse 7.10
Via RHSA-2021:5134 https://access.redhat.com/errata/RHSA-2021:5134
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=1942635
3:34 p.m.
New subject: [Bug 1942635] CVE-2021-21349 XStream: SSRF can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host
https://bugzilla.redhat.com/show_bug.cgi?id=1942635
errata-xmlrpc <errata-xmlrpc(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Link ID| |Red Hat Product Errata
| |RHSA-2021:5134
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=1942635
3:22 a.m.
New subject: [Bug 1942635] CVE-2021-21349 XStream: SSRF can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host
https://bugzilla.redhat.com/show_bug.cgi?id=1942635
--- Comment #22 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> ---
This issue has been addressed in the following products:
RHINT Camel-K 1.6.4
Via RHSA-2022:1029 https://access.redhat.com/errata/RHSA-2022:1029
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=1942635
3:22 a.m.
New subject: [Bug 1942635] CVE-2021-21349 XStream: SSRF can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host
https://bugzilla.redhat.com/show_bug.cgi?id=1942635
errata-xmlrpc <errata-xmlrpc(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Link ID| |Red Hat Product Errata
| |RHSA-2022:1029
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=1942635
816
days inactive
1180
days old
java-sig-commits@lists.fedoraproject.org
27 comments
1 participants
participants (1)
-
bugzilla＠redhat.com