xstream-1.3.1-14.el7

XStream is a Java XML serialization library to serialize objects to and deserialize object from XML.

Security Fix(es):

* XStream: remote command execution attack by manipulating the processed input stream (CVE-2021-29505)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

CVE-2021-29505
XStream is software for serializing Java objects to XML and back again. A vulnerability in XStream versions prior to 1.4.17 may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types is affected. The vulnerability is patched in version 1.4.17.