Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2021.3837
libxstream-java security update
11 November 2021
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: libxstream-java
Publisher: Debian
Operating System: Debian GNU/Linux
Impact/Access: Execute Arbitrary Code/Commands -- Remote/Unauthenticated
Modify Arbitrary Files -- Remote/Unauthenticated
Denial of Service -- Remote/Unauthenticated
Access Confidential Data -- Remote/Unauthenticated
Resolution: Patch/Upgrade
CVE Names: CVE-2021-39154 CVE-2021-39153 CVE-2021-39152
CVE-2021-39151 CVE-2021-39150 CVE-2021-39149
CVE-2021-39148 CVE-2021-39147 CVE-2021-39146
CVE-2021-39145 CVE-2021-39144 CVE-2021-39141
CVE-2021-39140 CVE-2021-39139 CVE-2021-29505
CVE-2021-21351 CVE-2021-21350 CVE-2021-21349
CVE-2021-21348 CVE-2021-21347 CVE-2021-21346
CVE-2021-21345 CVE-2021-21344 CVE-2021-21343
CVE-2021-21342 CVE-2021-21341
Reference: ASB-2021.0216
ASB-2021.0212
Original Bulletin:
http://www.debian.org/security/2021/dsa-5004
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
- - -------------------------------------------------------------------------
Debian Security Advisory DSA-5004-1 security@debian.org
https://www.debian.org/security/ Markus Koschany
November 10, 2021 https://www.debian.org/security/faq
- - -------------------------------------------------------------------------
Package : libxstream-java
CVE ID : CVE-2021-39139 CVE-2021-39140 CVE-2021-39141 CVE-2021-39144
CVE-2021-39145 CVE-2021-39146 CVE-2021-39147 CVE-2021-39148
CVE-2021-39149 CVE-2021-39150 CVE-2021-39151 CVE-2021-39152
CVE-2021-39153 CVE-2021-39154 CVE-2021-21341 CVE-2021-21342
CVE-2021-21343 CVE-2021-21344 CVE-2021-21345 CVE-2021-21346
CVE-2021-21347 CVE-2021-21348 CVE-2021-21349 CVE-2021-21350
CVE-2021-21351 CVE-2021-29505
Multiple security vulnerabilities have been discovered in XStream, a Java
library to serialize objects to XML and back again.
These vulnerabilities may allow a remote attacker to load and execute arbitrary
code from a remote host only by manipulating the processed input stream.
XStream itself sets up a whitelist by default now, i.e. it blocks all classes
except those types it has explicit converters for. It used to have a blacklist
by default, i.e. it tried to block all currently known critical classes of the
Java runtime. Main reason for the blacklist were compatibility, it allowed to
use newer versions of XStream as drop-in replacement. However, this approach
has failed. A growing list of security reports has proven, that a blacklist is
inherently unsafe, apart from the fact that types of 3rd libraries were not
even considered. A blacklist scenario should be avoided in general, because it
provides a false sense of security.
For the oldstable distribution (buster), these problems have been fixed
in version 1.4.11.1-1+deb10u3.
For the stable distribution (bullseye), these problems have been fixed in
version 1.4.15-3+deb11u1.
We recommend that you upgrade your libxstream-java packages.
For the detailed security status of libxstream-java please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/libxstream-java
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org
- -----BEGIN PGP SIGNATURE-----
iQKTBAEBCgB9FiEErPPQiO8y7e9qGoNf2a0UuVE7UeQFAmGMKzxfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEFD
RjNEMDg4RUYzMkVERUY2QTFBODM1RkQ5QUQxNEI5NTEzQjUxRTQACgkQ2a0UuVE7
UeR/IhAAqA5YC4n3hjvylquoUwqx09C1HG5YXUPe2FZJqCsRxhbYxt77FkJveAEY
L2G2HJsloJFJPaISRX/05WzHv0CIuzSLBakHqqJrgbQMWWGGFdyEwG2x3kxquWGt
BWP14wbMK44fdBsh2jC1S1UPcIamsQoZgm4bXtmaVe/CKLU62tKsTJ/l4rNXNPW7
npfDAoyd8ulYWwv9ERyg1NyHtcGRp/MueqYsDixFamrXl2IqsICGJQ1zEtjSQ+19
ysNwkJnAPQ10TxRIIDMSm2Xgr1+BkV7gbi6QAVvACAuNuuKwMTL1AAlujbO+aMBr
GT/kMHNk8hAowuln073yeL/p9PYvMPgSnBCLdyTa+UaW8/NMJ/cwkHLlXgMphdl1
odKSB4dRcgy1LfeIvq5fpBhm+ZgH7tqXb2a3sMNrrwd086sPD1nUN/IxMpk3hY7h
a5d1pgIJz/lSEwrme3BGv3wNP0bp//GeGb/ZLccuiH6Byz0X2BH5t1jfIyuFbK3i
I1T6eeEsWyjJQghZjSIsT0Kwra9qLNHGIoqu6p+zszAiR9xnMuyRaHhIs7+wQL1E
mgNpGZYioXLwM9uMUvokf4np47I8NVW4md1LjZ3rZvgITsnnP+o40Zrqv4cSVvVA
ENSlan16C9qpgTEWP12u3eJrYn2FfnGjjUWF8kCKvRgrEgOUP2g=
=m4T7
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBYYxsI+NLKJtyKPYoAQg6LRAAmf/oHwSKVrVAmTdPg6G1FRzoAl0F9cMY
QePEtVTFfUZX1I2Drt1ZZoazZH6qd2AmOJNWV0EsjikP6uuzsLKyldbOZLKzHOup
YXQ55XwTesKfuwtnJx3OapTena8YHBL9euX+NDtY41mbJkg7z9gBYIYR2kPB11Qr
zN4fg1gp/gTb3uZKOnks1XxY7LnfP9iXCF/uU8A37bgXc6Fhl1hgvle9q9TUkLl1
Ke9nZ/cjZnmBsl/YYZ2s7ZcJ1gbTZpxhqjtb/y5a31zkYsGdEGISCO05eRvM7QU4
kI1+FeRhQ5Dk93kAse0tHcmVig6kjf6w74NXYsrwn1s/6MW48I5VlaD1XKvPNuwA
fmRQhOPansCjXft+V69nZ+Tq85YY1YR4huSFrNgjvI31hwZJFUDCRKK9kwZdckfN
QV7Qk0QMj/PJo8Q8crw3CsQv8Z8zvTAE4e71d2c2H84xQxaYB0Pe+Q/ngjEicpf+
0FFc+3FtYCJLdplR8K0WFDqVFuuiyVyXdJLc+OxCK+oqWcOvh7GkwHTThURU0XPO
4vF8C685DO8IY9rgRpeEQIvrmNcCEqdV/wMTo9EiZGgK0ST4DTh3f/A1Z04ESKve
K4efltbef74SIbc4+I3MOGS5H028WlYVden+aHFQyrmH7ufX5efrt2bGDQzs72NA
XIeDtfuCoxw=
=w2hM
-----END PGP SIGNATURE-----