CVE-2021-29505

XStream is software for serializing Java objects to XML and back again. A vulnerability in XStream versions prior to 1.4.17 may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types is affected. The vulnerability is patched in version 1.4.17.

• Debian

  OS
  Debian
  10.011.09.0

• Fedora Project Fedora

  OS
  Fedoraproject
  333435

• Netapp Snapmanager

  APP
  Netapp
  all versions

• Oracle Banking Cash Management

  APP
  Oracle
  14.214.314.5

• Oracle Banking Corporate Lending Process Management

  APP
  Oracle
  14.2.014.3.014.5.0

• Oracle Banking Credit Facilities Process Management

  APP
  Oracle
  14.2.014.3.014.5.0

• Oracle Banking Supply Chain Finance

  APP
  Oracle
  14.2.0

• Oracle Banking Trade Finance Process Management

  APP
  Oracle
  14.5.0

• Oracle Business Activity Monitoring

  APP
  Oracle
  11.1.1.9.012.2.1.3.012.2.1.4.0

• Oracle Communications Brm Elastic Charging Engine

  APP
  Oracle
  11.312.0

• Oracle Communications Unified Inventory Management

  APP
  Oracle
  7.3.47.3.57.4.07.4.17.4.2

• Oracle Enterprise Manager Ops Center

  APP
  Oracle
  12.4.0.0

• Oracle Retail Customer Insights

  APP
  Oracle
  15.0.216.0.2

• Oracle Retail Xstore Point Of Service

  APP
  Oracle
  16.0.617.0.418.0.319.0.220.0.1

• Oracle Webcenter Portal

  APP
  Oracle
  12.2.1.3.012.2.1.4.0

• Oracle Webcenter Sites

  APP
  Oracle
  12.2.1.3.012.2.1.4.0

• Xstream

  APP
  Xstream
  < 1.4.17