CVE-2021-29505

Name of the Vulnerable Software and Affected Versions XStream versions prior to 1.4.17

Description A vulnerability in XStream may allow a remote attacker with sufficient rights to execute commands of the host by manipulating the processed input stream. The issue is related to shortcomings in the deserialization mechanism. Users who set up XStream's security framework with a whitelist limited to the minimal required types are not affected.

Recommendations For versions prior to 1.4.17, update to version 1.4.17 to resolve the issue. As a temporary workaround, consider setting up XStream's security framework with a whitelist limited to the minimal required types to minimize the risk of exploitation.