CVE-2021-39154 SUSE CVE security@suse.de SUSE Security Team SUSE CVE-2021-39154 Interim 1 42 2025-12-23T03:12:18Z current 2021-08-26T01:06:20Z 2025-12-23T03:12:18Z cve-database/bin/generate-cvrf-cve.pl 2020-12-27T01:00:00Z CVE-2021-39154 XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). https://lists.suse.com/pipermail/sle-updates/2021-October/020532.html E-Mail link for SUSE-SU-2021:3476-1 https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/PVLPNQBYDFG66KQSVPOIZDRX3AQEQYGU/ E-Mail link for openSUSE-SU-2021:1401-1 https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/VPBFWNADZPOCG7HFCC7XX4AVNU7NTF4P/ E-Mail link for openSUSE-SU-2021:3476-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings Container suse/manager/5.0/x86_64/server:5.0.0-beta1.2.122 Container suse/multi-linux-manager/5.1/x86_64/server:5.1.0.6.40 Image SLES15-SP3-Manager-4-2-Server-BYOS-Azure Image SLES15-SP3-Manager-4-2-Server-BYOS-EC2-HVM Image SLES15-SP3-Manager-4-2-Server-BYOS-GCE Image SLES15-SP4-Manager-Server-4-3 Image SLES15-SP4-Manager-Server-4-3-Azure-llc Image SLES15-SP4-Manager-Server-4-3-Azure-ltd Image SLES15-SP4-Manager-Server-4-3-BYOS Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2 Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE Image SLES15-SP4-Manager-Server-4-3-EC2-llc Image SLES15-SP4-Manager-Server-4-3-EC2-ltd Image server-image SUSE Linux Enterprise Module for Development Tools 15 SP2 SUSE Linux Enterprise Module for Development Tools 15 SP3 SUSE Liberty Linux 7 SUSE Liberty Linux 7 LTSS SUSE Linux Enterprise Module for Development Tools 15 SP2 SUSE Linux Enterprise Module for Development Tools 15 SP3 SUSE Linux Enterprise Module for Development Tools 15 SP4 SUSE Linux Enterprise Module for Development Tools 15 SP5 SUSE Linux Enterprise Module for Development Tools 15 SP6 SUSE Linux Enterprise Module for Development Tools 15 SP7 SUSE Linux Enterprise Module for Development Tools 15 SP2 SUSE Linux Enterprise Module for Development Tools 15 SP3 SUSE Linux Enterprise Module for Development Tools 15 SP4 SUSE Linux Enterprise Module for Development Tools 15 SP5 SUSE Linux Enterprise Module for Development Tools 15 SP6 SUSE Linux Enterprise Module for Development Tools 15 SP7 SUSE Linux Enterprise Module for Development Tools 15 SP2 SUSE Linux Enterprise Module for Development Tools 15 SP3 SUSE Linux Enterprise Module for Development Tools 15 SP4 SUSE Linux Enterprise Module for Development Tools 15 SP5 SUSE Linux Enterprise Module for Development Tools 15 SP6 SUSE Linux Enterprise Module for Development Tools 15 SP7 SUSE Linux Enterprise Module for Development Tools 15 SP2 SUSE Linux Enterprise Module for Development Tools 15 SP3 SUSE Linux Enterprise Module for Development Tools 15 SP4 SUSE Linux Enterprise Module for Development Tools 15 SP5 SUSE Linux Enterprise Module for Development Tools 15 SP6 SUSE Linux Enterprise Module for Development Tools 15 SP7 SUSE Linux Enterprise Module for Development Tools 15 SP2 SUSE Linux Enterprise Module for Development Tools 15 SP3 SUSE Linux Enterprise Module for Development Tools 15 SP4 SUSE Linux Enterprise Module for Development Tools 15 SP2 SUSE Linux Enterprise Module for Development Tools 15 SP3 SUSE Linux Enterprise Module for Development Tools 15 SP4 SUSE Linux Enterprise Module for Development Tools 15 SP2 SUSE Linux Enterprise Module for Development Tools 15 SP3 SUSE Linux Enterprise Module for Development Tools 15 SP4 SUSE Manager Server Module 4.1 SUSE Manager Server Module 4.2 openSUSE Leap 15.2 openSUSE Leap 15.3 xstream-1.3.1-16.el7_9 xstream-1.4.18-3.14.1 xstream-1.4.18-lp152.2.12.1 xstream-benchmark-1.4.18-3.14.1 xstream-benchmark-1.4.18-lp152.2.12.1 xstream-javadoc-1.3.1-16.el7_9 xstream-javadoc-1.4.18-3.14.1 xstream-javadoc-1.4.18-lp152.2.12.1 xstream-parent-1.4.18-3.14.1 xstream-parent-1.4.18-lp152.2.12.1 xstream-1.4.18-3.14.1 as a component of Container suse/manager/5.0/x86_64/server:5.0.0-beta1.2.122 xstream-1.4.18-3.14.1 as a component of Container suse/multi-linux-manager/5.1/x86_64/server:5.1.0.6.40 xstream-1.4.18-3.14.1 as a component of Image SLES15-SP3-Manager-4-2-Server-BYOS-Azure xstream-1.4.18-3.14.1 as a component of Image SLES15-SP3-Manager-4-2-Server-BYOS-EC2-HVM xstream-1.4.18-3.14.1 as a component of Image SLES15-SP3-Manager-4-2-Server-BYOS-GCE xstream-1.4.18-3.14.1 as a component of Image SLES15-SP4-Manager-Server-4-3 xstream-1.4.18-3.14.1 as a component of Image SLES15-SP4-Manager-Server-4-3-Azure-llc xstream-1.4.18-3.14.1 as a component of Image SLES15-SP4-Manager-Server-4-3-Azure-ltd xstream-1.4.18-3.14.1 as a component of Image SLES15-SP4-Manager-Server-4-3-BYOS xstream-1.4.18-3.14.1 as a component of Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure xstream-1.4.18-3.14.1 as a component of Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2 xstream-1.4.18-3.14.1 as a component of Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE xstream-1.4.18-3.14.1 as a component of Image SLES15-SP4-Manager-Server-4-3-EC2-llc xstream-1.4.18-3.14.1 as a component of Image SLES15-SP4-Manager-Server-4-3-EC2-ltd xstream-1.4.18-3.14.1 as a component of Image server-image xstream-1.3.1-16.el7_9 as a component of SUSE Liberty Linux 7 xstream-javadoc-1.3.1-16.el7_9 as a component of SUSE Liberty Linux 7 xstream-1.3.1-16.el7_9 as a component of SUSE Liberty Linux 7 LTSS xstream-javadoc-1.3.1-16.el7_9 as a component of SUSE Liberty Linux 7 LTSS xstream-1.4.18-3.14.1 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP2 xstream-1.4.18-3.14.1 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP3 xstream-1.4.18-3.14.1 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP4 xstream-1.4.18-3.14.1 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP5 xstream-1.4.18-3.14.1 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP6 xstream-1.4.18-3.14.1 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP7 xstream-1.4.18-3.14.1 as a component of SUSE Manager Server Module 4.1 xstream-1.4.18-3.14.1 as a component of SUSE Manager Server Module 4.2 xstream-1.4.18-lp152.2.12.1 as a component of openSUSE Leap 15.2 xstream-benchmark-1.4.18-lp152.2.12.1 as a component of openSUSE Leap 15.2 xstream-javadoc-1.4.18-lp152.2.12.1 as a component of openSUSE Leap 15.2 xstream-parent-1.4.18-lp152.2.12.1 as a component of openSUSE Leap 15.2 xstream-1.4.18-3.14.1 as a component of openSUSE Leap 15.3 xstream-benchmark-1.4.18-3.14.1 as a component of openSUSE Leap 15.3 xstream-javadoc-1.4.18-3.14.1 as a component of openSUSE Leap 15.3 xstream-parent-1.4.18-3.14.1 as a component of openSUSE Leap 15.3 XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose. CVE-2021-39154 Container suse/manager/5.0/x86_64/server:5.0.0-beta1.2.122:xstream-1.4.18-3.14.1 Container suse/multi-linux-manager/5.1/x86_64/server:5.1.0.6.40:xstream-1.4.18-3.14.1 Image SLES15-SP3-Manager-4-2-Server-BYOS-Azure:xstream-1.4.18-3.14.1 Image SLES15-SP3-Manager-4-2-Server-BYOS-EC2-HVM:xstream-1.4.18-3.14.1 Image SLES15-SP3-Manager-4-2-Server-BYOS-GCE:xstream-1.4.18-3.14.1 Image SLES15-SP4-Manager-Server-4-3:xstream-1.4.18-3.14.1 Image SLES15-SP4-Manager-Server-4-3-Azure-llc:xstream-1.4.18-3.14.1 Image SLES15-SP4-Manager-Server-4-3-Azure-ltd:xstream-1.4.18-3.14.1 Image SLES15-SP4-Manager-Server-4-3-BYOS:xstream-1.4.18-3.14.1 Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure:xstream-1.4.18-3.14.1 Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2:xstream-1.4.18-3.14.1 Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE:xstream-1.4.18-3.14.1 Image SLES15-SP4-Manager-Server-4-3-EC2-llc:xstream-1.4.18-3.14.1 Image SLES15-SP4-Manager-Server-4-3-EC2-ltd:xstream-1.4.18-3.14.1 Image server-image:xstream-1.4.18-3.14.1 SUSE Liberty Linux 7:xstream-1.3.1-16.el7_9 SUSE Liberty Linux 7:xstream-javadoc-1.3.1-16.el7_9 SUSE Liberty Linux 7 LTSS:xstream-1.3.1-16.el7_9 SUSE Liberty Linux 7 LTSS:xstream-javadoc-1.3.1-16.el7_9 SUSE Linux Enterprise Module for Development Tools 15 SP2:xstream-1.4.18-3.14.1 SUSE Linux Enterprise Module for Development Tools 15 SP3:xstream-1.4.18-3.14.1 SUSE Linux Enterprise Module for Development Tools 15 SP4:xstream-1.4.18-3.14.1 SUSE Linux Enterprise Module for Development Tools 15 SP5:xstream-1.4.18-3.14.1 SUSE Linux Enterprise Module for Development Tools 15 SP6:xstream-1.4.18-3.14.1 SUSE Linux Enterprise Module for Development Tools 15 SP7:xstream-1.4.18-3.14.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP4:xstream-benchmark-1.4.18-3.14.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP4:xstream-javadoc-1.4.18-3.14.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP4:xstream-parent-1.4.18-3.14.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP5:xstream-benchmark-1.4.18-3.14.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP5:xstream-javadoc-1.4.18-3.14.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP5:xstream-parent-1.4.18-3.14.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP6:xstream-benchmark-1.4.18-3.14.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP6:xstream-javadoc-1.4.18-3.14.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP6:xstream-parent-1.4.18-3.14.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP7:xstream-benchmark-1.4.18-3.14.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP7:xstream-javadoc-1.4.18-3.14.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP7:xstream-parent-1.4.18-3.14.1 SUSE Manager Server Module 4.1:xstream-1.4.18-3.14.1 SUSE Manager Server Module 4.2:xstream-1.4.18-3.14.1 openSUSE Leap 15.2:xstream-1.4.18-lp152.2.12.1 openSUSE Leap 15.2:xstream-benchmark-1.4.18-lp152.2.12.1 openSUSE Leap 15.2:xstream-javadoc-1.4.18-lp152.2.12.1 openSUSE Leap 15.2:xstream-parent-1.4.18-lp152.2.12.1 openSUSE Leap 15.3:xstream-1.4.18-3.14.1 openSUSE Leap 15.3:xstream-benchmark-1.4.18-3.14.1 openSUSE Leap 15.3:xstream-javadoc-1.4.18-3.14.1 openSUSE Leap 15.3:xstream-parent-1.4.18-3.14.1 important 6 AV:N/AC:M/Au:S/C:P/I:P/A:P 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H