Yüksek CVSS 7.5 PoC var
CVE-2021-21341: Oncommand Insight: denetimsiz kaynak tüketimi
Açıklama (NVD)
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is vulnerability which may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a payload resulting in a denial of service only by manipulating the processed input stream. No user is affected who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.
Özet bilgiler
- Ürün
- Netapp Oncommand Insight
- CVSS v3.1
- 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - EPSS
- %77,80 (yüzdelik 100)
- CWE
- CWE-400
- Yama
- Mevcut
Etkilenen sürümler
| Ürün | Başlangıç | Bitiş | Düzeltildi |
|---|---|---|---|
| netapp-oncommand-insight | — | — | — |
| apache-activemq | — | — | 5.15.14 |
| apache-activemq | 5.16.0 | 5.16.0 | — |
| apache-activemq | 5.16.1 | 5.16.1 | — |
| apache-jmeter | — | — | 5.5 |
| xstream-xstream | — | — | 1.4.16 |
| debian-debian-linux | 9.0 | 9.0 | — |
| debian-debian-linux | 10.0 | 10.0 | — |
| debian-debian-linux | 11.0 | 11.0 | — |
| fedoraproject-fedora | 33 | 33 | — |
| fedoraproject-fedora | 34 | 34 | — |
| fedoraproject-fedora | 35 | 35 | — |
| oracle-banking-enterprise-default-management | 2.10.0 | 2.10.0 | — |
| oracle-banking-enterprise-default-management | 2.12.0 | 2.12.0 | — |
| oracle-banking-platform | 2.4.0 | 2.4.0 | — |
| oracle-banking-platform | 2.7.1 | 2.7.1 | — |
| oracle-banking-platform | 2.9.0 | 2.9.0 | — |
| oracle-banking-platform | 2.12.0 | 2.12.0 | — |
| oracle-business-activity-monitoring | 11.1.1.9.0 | 11.1.1.9.0 | — |
| oracle-business-activity-monitoring | 12.2.1.3.0 | 12.2.1.3.0 | — |
| oracle-business-activity-monitoring | 12.2.1.4.0 | 12.2.1.4.0 | — |
| oracle-communications-billing-and-revenue-management-elastic-charging-engine | 12.0.0.3.0 | 12.0.0.3.0 | — |
| oracle-communications-unified-inventory-management | 7.3.2 | 7.3.2 | — |
| oracle-communications-unified-inventory-management | 7.3.4 | 7.3.4 | — |
| oracle-communications-unified-inventory-management | 7.3.5 | 7.3.5 | — |
| oracle-communications-unified-inventory-management | 7.4.0 | 7.4.0 | — |
| oracle-communications-unified-inventory-management | 7.4.1 | 7.4.1 | — |
| oracle-retail-xstore-point-of-service | 16.0.6 | 16.0.6 | — |
| oracle-retail-xstore-point-of-service | 17.0.4 | 17.0.4 | — |
| oracle-retail-xstore-point-of-service | 18.0.3 | 18.0.3 | — |
Kaynaklar
- NVD kaydı
- x-stream.github.io
- github.com
- lists.apache.org
- lists.apache.org
- lists.debian.org
- lists.fedoraproject.org
- lists.fedoraproject.org
- lists.fedoraproject.org
- security.netapp.com
- www.debian.org
- www.oracle.com
- www.oracle.com
- www.oracle.com
- x-stream.github.io
- x-stream.github.io
- x-stream.github.io
- github.com
- lists.apache.org
- lists.apache.org
- lists.debian.org
- lists.fedoraproject.org
- lists.fedoraproject.org
- lists.fedoraproject.org
- security.netapp.com
- CWE-400