CVE-2021-39147

Name of the Vulnerable Software and Affected Versions XStream versions prior to 1.4.18

Description The issue allows a remote attacker to load and execute arbitrary code from a remote host by manipulating the processed input stream. Users who set up XStream's security framework with a whitelist limited to the minimal required types are not affected. The vulnerability is related to the use of a blacklist, which cannot be secured for general purpose, and has been addressed in XStream 1.4.18 by using a whitelist by default.

Recommendations For versions prior to 1.4.18, setup XStream's security framework with a whitelist limited to the minimal required types to prevent exploitation. As a temporary workaround, consider configuring the security framework to only allow the necessary types until a patch is available.