Security update for xstream SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2021:1995-1 Final 1 1 2021-06-17T13:12:06Z current 2021-06-17T13:12:06Z 2021-06-17T13:12:06Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for xstream This update for xstream fixes the following issues: Upgrade to 1.4.17 - CVE-2021-29505: Fixed potential code execution when unmarshalling with XStream instances using an uninitialized security framework (bsc#1186651) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Image SLES15-SP3-Manager-4-2-Server-BYOS-Azure-2021-1995,Image SLES15-SP3-Manager-4-2-Server-BYOS-EC2-HVM-2021-1995,Image SLES15-SP3-Manager-4-2-Server-BYOS-GCE-2021-1995,Image SLES15-SP4-Manager-Server-4-3-BYOS-2021-1995,Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure-2021-1995,Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2-2021-1995,Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE-2021-1995,SUSE-2021-1995,SUSE-SLE-Module-Development-Tools-15-SP2-2021-1995,SUSE-SLE-Module-Development-Tools-15-SP3-2021-1995,SUSE-SLE-Module-SUSE-Manager-Server-4.1-2021-1995,SUSE-SLE-Module-SUSE-Manager-Server-4.2-2021-1995 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2021/suse-su-20211995-1/ Link for SUSE-SU-2021:1995-1 https://lists.suse.com/pipermail/sle-security-updates/2021-June/009027.html E-Mail link for SUSE-SU-2021:1995-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1186651 SUSE Bug 1186651 https://www.suse.com/security/cve/CVE-2021-29505/ SUSE CVE CVE-2021-29505 page Image SLES15-SP3-Manager-4-2-Server-BYOS-Azure Image SLES15-SP3-Manager-4-2-Server-BYOS-EC2-HVM Image SLES15-SP3-Manager-4-2-Server-BYOS-GCE Image SLES15-SP4-Manager-Server-4-3-BYOS Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2 Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE SUSE Linux Enterprise Module for Development Tools 15 SP2 SUSE Linux Enterprise Module for Development Tools 15 SP3 SUSE Manager Server Module 4.1 SUSE Manager Server Module 4.2 xstream-1.4.17-3.11.2 xstream-benchmark-1.4.17-3.11.2 xstream-javadoc-1.4.17-3.11.2 xstream-parent-1.4.17-3.11.2 xstream-1.4.17-3.11.2 as a component of Image SLES15-SP3-Manager-4-2-Server-BYOS-Azure xstream-1.4.17-3.11.2 as a component of Image SLES15-SP3-Manager-4-2-Server-BYOS-EC2-HVM xstream-1.4.17-3.11.2 as a component of Image SLES15-SP3-Manager-4-2-Server-BYOS-GCE xstream-1.4.17-3.11.2 as a component of Image SLES15-SP4-Manager-Server-4-3-BYOS xstream-1.4.17-3.11.2 as a component of Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure xstream-1.4.17-3.11.2 as a component of Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2 xstream-1.4.17-3.11.2 as a component of Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE xstream-1.4.17-3.11.2 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP2 xstream-1.4.17-3.11.2 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP3 xstream-1.4.17-3.11.2 as a component of SUSE Manager Server Module 4.1 xstream-1.4.17-3.11.2 as a component of SUSE Manager Server Module 4.2 XStream is software for serializing Java objects to XML and back again. A vulnerability in XStream versions prior to 1.4.17 may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types is affected. The vulnerability is patched in version 1.4.17. CVE-2021-29505 Image SLES15-SP3-Manager-4-2-Server-BYOS-Azure:xstream-1.4.17-3.11.2 Image SLES15-SP3-Manager-4-2-Server-BYOS-EC2-HVM:xstream-1.4.17-3.11.2 Image SLES15-SP3-Manager-4-2-Server-BYOS-GCE:xstream-1.4.17-3.11.2 Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure:xstream-1.4.17-3.11.2 Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2:xstream-1.4.17-3.11.2 Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE:xstream-1.4.17-3.11.2 Image SLES15-SP4-Manager-Server-4-3-BYOS:xstream-1.4.17-3.11.2 SUSE Linux Enterprise Module for Development Tools 15 SP2:xstream-1.4.17-3.11.2 SUSE Linux Enterprise Module for Development Tools 15 SP3:xstream-1.4.17-3.11.2 SUSE Manager Server Module 4.1:xstream-1.4.17-3.11.2 SUSE Manager Server Module 4.2:xstream-1.4.17-3.11.2 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-20211995-1/ https://www.suse.com/security/cve/CVE-2021-29505.html CVE-2021-29505 https://bugzilla.suse.com/1186651 SUSE Bug 1186651