CVE-2021-39144 in xstream
The LogPulse agent checks every host for the vulnerable version of this software, so you see where the CVE is present.
What the vulnerability is
XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.
Affected software: xstream, debian linux, fedoraproject fedora, netapp snapmanager, oracle business activity monitoring, oracle commerce guided search, oracle communications billing and revenue management elastic charging engine, oracle communications cloud native core automated test suite, oracle communications cloud native core binding support function, oracle communications cloud native core policy
Scores
- CVSS: 8.5 (high)
- EPSS: 98.12% chance of exploitation in the next 30 days
- CISA KEV: Known exploited, listed 2023-03-10
- Published: 2021-08-23
What LogPulse has for it
- Detection rule: No
- Agent check (vulnerable version): Yes, published
- Mitigation: No
Source data: NIST NVD, CISA KEV and FIRST EPSS. LogPulse processes new CVEs every hour.
We build every detection with great care, but no two environments are the same. Log sources, parsing and configuration differ, so test a detection in your own environment before you rely on it.