High severity7.5NVD Advisory· Published May 28, 2021· Updated Jun 17, 2026

CVE-2021-29505

Description

XStream is software for serializing Java objects to XML and back again. A vulnerability in XStream versions prior to 1.4.17 may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types is affected. The vulnerability is patched in version 1.4.17.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
com.thoughtworks.xstream:xstreamMaven	< 1.4.17	1.4.17

Affected products

NetApp/Snapmanager2 versions
cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:oracle:*:*+ 1 more
- cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:oracle:*:*
- cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:sap:*:*
Oracle Corporation/Banking Cash Management3 versions
cpe:2.3:a:oracle:banking_cash_management:14.2:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:oracle:banking_cash_management:14.2:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:banking_cash_management:14.3:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:banking_cash_management:14.5:*:*:*:*:*:*:*
Oracle Corporation/Banking Corporate Lending Process Management3 versions
cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.2.0:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.5.0:*:*:*:*:*:*:*
Oracle Corporation/Banking Credit Facilities Process Management3 versions
cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.2.0:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.5.0:*:*:*:*:*:*:*
Oracle Corporation/Banking Supply Chain Finance
cpe:2.3:a:oracle:banking_supply_chain_finance:14.2.0:*:*:*:*:*:*:*
Oracle Corporation/Banking Trade Finance Process Management
cpe:2.3:a:oracle:banking_trade_finance_process_management:14.5.0:*:*:*:*:*:*:*
Oracle Corporation/Business Activity Monitoring3 versions
cpe:2.3:a:oracle:business_activity_monitoring:11.1.1.9.0:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:oracle:business_activity_monitoring:11.1.1.9.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:business_activity_monitoring:12.2.1.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:business_activity_monitoring:12.2.1.4.0:*:*:*:*:*:*:*
Oracle Corporation/Communications Brm Elastic Charging Engine2 versions
cpe:2.3:a:oracle:communications_brm_-_elastic_charging_engine:11.3:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:oracle:communications_brm_-_elastic_charging_engine:11.3:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:communications_brm_-_elastic_charging_engine:12.0:*:*:*:*:*:*:*
Oracle Corporation/Communications Unified Inventory Management5 versions
cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.4:*:*:*:*:*:*:*+ 4 more
- cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.4:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.5:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.1:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.2:*:*:*:*:*:*:*
Oracle Corporation/Enterprise Manager Ops Center
cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0.0:*:*:*:*:*:*:*
Oracle Corporation/Retail Customer Insights2 versions
cpe:2.3:a:oracle:retail_customer_insights:15.0.2:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:oracle:retail_customer_insights:15.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_customer_insights:16.0.2:*:*:*:*:*:*:*
Oracle Corporation/Retail Xstore Point Of Service5 versions
cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0.6:*:*:*:*:*:*:*+ 4 more
- cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0.6:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_xstore_point_of_service:18.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_xstore_point_of_service:19.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_xstore_point_of_service:20.0.1:*:*:*:*:*:*:*
Oracle Corporation/Webcenter Portal2 versions
cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0:*:*:*:*:*:*:*
Oracle Corporation/Webcenter Sites2 versions
cpe:2.3:a:oracle:webcenter_sites:12.2.1.3.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:oracle:webcenter_sites:12.2.1.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:webcenter_sites:12.2.1.4.0:*:*:*:*:*:*:*
Xstream/Xstream2 versions
cpe:2.3:a:xstream:xstream:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:xstream:xstream:*:*:*:*:*:*:*:*range: <1.4.17
- (no CPE)range: < 1.4.17
Debian/linux3 versions
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
Fedoraproject/Fedora3 versions
cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
ghsa-coords8 versions
pkg:maven/com.thoughtworks.xstream/xstream pkg:rpm/opensuse/xstream&distro=openSUSE%20Leap%2015.2 pkg:rpm/opensuse/xstream&distro=openSUSE%20Leap%2015.3 pkg:rpm/opensuse/xstream&distro=openSUSE%20Tumbleweed pkg:rpm/suse/xstream&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015%20SP2 pkg:rpm/suse/xstream&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015%20SP3 pkg:rpm/suse/xstream&distro=SUSE%20Manager%20Server%20Module%204.1 pkg:rpm/suse/xstream&distro=SUSE%20Manager%20Server%20Module%204.2
< 1.4.17+ 7 more
- (no CPE)range: < 1.4.17
- (no CPE)range: < 1.4.17-lp152.2.9.1
- (no CPE)range: < 1.4.17-3.11.2
- (no CPE)range: < 1.4.18-1.1
- (no CPE)range: < 1.4.17-3.11.2
- (no CPE)range: < 1.4.17-3.11.2
- (no CPE)range: < 1.4.17-3.11.2
- (no CPE)range: < 1.4.17-3.11.2

Patches

Vulnerability mechanics

References

github.com/x-stream/xstream/commit/24fac82191292c6ae25f94508d28b9823f83624fnvdPatchThird Party AdvisoryWEB
www.oracle.com/security-alerts/cpuapr2022.htmlnvdPatchThird Party AdvisoryWEB
www.oracle.com/security-alerts/cpujan2022.htmlnvdPatchThird Party AdvisoryWEB
github.com/advisories/GHSA-7chv-rrw6-w6fcghsaADVISORY
github.com/x-stream/xstream/security/advisories/GHSA-7chv-rrw6-w6fcnvdThird Party AdvisoryWEB
lists.debian.org/debian-lts-announce/2021/07/msg00004.htmlnvdMailing ListThird Party AdvisoryWEB
nvd.nist.gov/vuln/detail/CVE-2021-29505ghsaADVISORY
security.netapp.com/advisory/ntap-20210708-0007/nvdThird Party Advisory
www.debian.org/security/2021/dsa-5004nvdThird Party AdvisoryWEB
www.oracle.com/security-alerts/cpujul2022.htmlnvdThird Party AdvisoryWEB
www.oracle.com/security-alerts/cpuoct2021.htmlnvdMailing ListThird Party AdvisoryWEB
github.com/x-stream/xstream/commit/f0c4a8d861b68ffc3119cfbbbd632deee624e227nvdWEB
lists.apache.org/thread.html/r8ee51debf7fd184b6a6b020dc31df25118b0aa612885f12fbe77f04f%40%3Cdev.jmeter.apache.org%3EnvdIssue TrackingMailing ListWEB
lists.apache.org/thread.html/r8ee51debf7fd184b6a6b020dc31df25118b0aa612885f12fbe77f04f@%3Cdev.jmeter.apache.org%3EnvdWEB
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHPghsaWEB
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/nvdMailing List
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7ghsaWEB
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/nvdMailing List
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREBghsaWEB
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/nvdMailing List
lists.fedoraproject.org/archives/list/[email protected]/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHPnvdWEB
lists.fedoraproject.org/archives/list/[email protected]/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7nvdWEB
lists.fedoraproject.org/archives/list/[email protected]/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREBnvdWEB
security.netapp.com/advisory/ntap-20210708-0007nvdWEB
x-stream.github.io/CVE-2021-29505.htmlnvdWEB

News mentions

No linked articles in our index yet.

cvss	0.488
epss	0.062
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000