OESA-2022-1512

    Dashboard / Vulnerabilities / OESA-2022-1512

    OESA-2022-1512

    Published: 11 Feb 2022Last Modified: 18 Aug 2026
    Upstream:
    CVE-2021-43859

    Summary: xstream security update

    Details: Java XML serialization library. Security Fix(es): XStream is an open source java library to serialize objects to XML and back again. Versions prior to 1.4.19 may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a payload resulting in a denial of service only by manipulating the processed input stream. XStream 1.4.19 monitors and accumulates the time it takes to add elements to collections and throws an exception if a set threshold is exceeded. Users are advised to upgrade as soon as possible. Users unable to upgrade may set the NO_REFERENCE mode to prevent recursion. See GHSA-rmr5-cpv2-vgjf for further details on a workaround if an upgrade is not possible.(CVE-2021-43859)

    References: https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1512, https://nvd.nist.gov/vuln/detail/CVE-2021-43859

    Affected packages

    Package

    Name: xstream

    Purl: pkg:rpm/openEuler/xstream&distro=openEuler-20.03-LTS-SP1

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -1.4.18-2.oe1

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    OESA-2022-1512 | CVE-DB