References https://stack.chaitin.com/vuldb/detail/a82ef68d-7c49-418e-97a6-a19bf4eee593 https://www.cnvd.org.cn/flaw/show/CNVD-2021-67822 https://github.com/x-stream/xstream/security/advisories/GHSA-h7v4-7xg3-hxcc https://nvd.nist.gov/vuln/detail/CVE-2021-39154 https://x-stream.github.io/CVE-2021-39154.html https://security.snyk.io/vuln/SNYK-JAVA-COMTHOUGHTWORKSXSTREAM-1569185 https://www.cnvd.org.cn/flaw/show/CNVD-2021-28335 https://github.com/advisories/GHSA-2q8x-2p7f-574v
Related VulnerabilitiesPoCCVE-2013-7285: XStream <1.4.6/1.4.10 - Remote Code ExecutionPoCCVE-2020-26217: XStream <1.4.14 - Remote Code ExecutionPoCCVE-2020-26258: XStream <1.4.15 - Server-Side Request ForgeryPoCCVE-2021-21345: XStream < 1.4.16 - Remote Code ExecutionPoCCVE-2021-21351: XStream <1.4.16 - Remote Code ExecutionPoCCVE-2021-29505: XStream <1.4.17 - Remote Code ExecutionPoCCVE-2021-39141: XStream 1.4.18 - Remote Code ExecutionPoCCVE-2021-39144: XStream 1.4.18 - Remote Code ExecutionPoCCVE-2021-39146: XStream 1.4.18 - Arbitrary Code ExecutionPoCCVE-2021-39152: XStream <1.4.18 - Server-Side Request ForgeryPoCvmware-nsx-stream-rce: VMware NSX Manager XStream Pre-authenticated Remote Code ExecutionEasySite Xstream 反序列化漏洞Xstream Project Xstream 栈溢出漏洞 可致拒绝服务