VDB
BDU%3A2022-00708
BDU%3A2022-00708
PUBLISHED
CVSS 6.5 MEDIUM
Уязвимость Java-библиотеки для преобразования объектов в XML или JSON формат XStream , связанная с недостатками механизма десериализации, позволяющая нарушителю выполнить произвольный код
Risk Scores
CVSS 2.0
6.5
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat Inc., Сообщество свободного программного обеспечения, Novell Inc., Fedora Project, Xstream Project | Red Hat Enterprise Linux, Debian GNU/Linux, Red Hat Descision Manager, OpenSUSE Leap, Data Grid, Red Hat Process Automation, Fedora, Red Hat Integration Camel Quarkus, Red Hat CodeReady Studio, XStream |
Timeline
- Feb 10, 2022 CVE Published
- Mar 19, 2026 Distribution Patch
References
- https://github.com/x-stream/xstream/security/advisories/GHSA-64xx-cq4q-mf44 url
- https://x-stream.github.io/CVE-2021-39139.html url
- https://security.netapp.com/advisory/ntap-20210923-0003/ url
- https://lists.debian.org/debian-lts-announce/2021/09/msg00017.html url
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/ url
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/ url
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/ url
- https://www.debian.org/security/2021/dsa-5004 url
- https://www.suse.com/security/cve/CVE-2021-39139 advisory
- https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-39139.xml advisory
- https://lists.fedoraproject.org/archives/search?mlist=package-announce%40lists.fedoraproject.org&q=CVE-2021-39139 advisory
- https://security-tracker.debian.org/tracker/CVE-2021-39139 advisory