CVE-2021-21350: 
Java vulnerability analysis and mitigation

CVE-2021-21350 affects XStream versions before 1.4.16. XStream is a Java library to serialize objects to XML and back again. The vulnerability allows a remote attacker to execute arbitrary code by manipulating the processed input stream. No user is affected who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types (GitHub Advisory, XStream Changes).

The vulnerability exists because XStream creates new instances based on type information contained in the processed stream at unmarshalling time. An attacker can manipulate the input stream and replace or inject objects that result in arbitrary code execution. The vulnerability has a CVSS v3.1 Base Score of 9.8 (CRITICAL) with vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (NVD).

A successful exploitation of this vulnerability could allow remote attackers to execute arbitrary code on the affected system by manipulating the processed input stream. This could lead to complete system compromise, including unauthorized access to sensitive data, system modifications, or service disruption (XStream CVE).

The vulnerability is remotely exploitable without requiring authentication. An attacker only needs the ability to send malicious XML data to be processed by XStream. A proof-of-concept exploit exists that demonstrates code execution by injecting malicious payloads through XML deserialization (XStream CVE).

The primary mitigation is to upgrade to XStream version 1.4.16 or later. For users who cannot upgrade, XStream provides a security framework to implement a whitelist for allowed types. Users should configure the security framework to explicitly define which types are allowed during deserialization. The recommended approach is to use a whitelist rather than a blacklist to minimize security risks (XStream Security).

Multiple organizations and vendors issued security advisories and patches in response to this vulnerability, including Oracle, Red Hat, Debian, and NetApp. The vulnerability was widely acknowledged as critical due to its potential for remote code execution (NetApp Advisory, Debian Advisory).