CVE-2021-39139: 
Java vulnerability analysis and mitigation

XStream, a Java library used to serialize objects to XML and back again, was found to contain a vulnerability (CVE-2021-39139) that allows remote attackers to execute arbitrary code by manipulating the processed input stream. The vulnerability affects all versions up to and including version 1.4.17, particularly when using the software out of the box with JDK 1.7u21 or below. However, the vulnerability can be exploited regardless of Java runtime version if an external Xalan is used (XStream CVE).

The vulnerability exists in XStream's unmarshalling process where the stream contains type information to recreate previously written objects. During unmarshalling, XStream creates new instances based on this type information. An attacker can manipulate the input stream to replace or inject objects that result in execution of arbitrary code loaded from a remote server. The vulnerability has received a CVSS v3.1 base score of 8.8 (HIGH) with the vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (NVD).

A successful exploitation of this vulnerability allows remote attackers to execute arbitrary code on the affected system by manipulating the processed input stream. This can lead to complete system compromise, including unauthorized access to sensitive data, system modifications, and potential service disruptions (NetApp Advisory).

The vulnerability has been fixed in XStream version 1.4.18, which implements a whitelist-based security framework by default instead of the previous blacklist approach. Users are strongly recommended to upgrade to this version. For those unable to upgrade immediately, it is recommended to set up XStream's security framework with a whitelist limited to the minimal required types (Debian Advisory).

Multiple organizations and vendors have responded to this vulnerability by releasing security advisories and patches, including NetApp, Oracle, and Debian. The vulnerability has been incorporated into various security updates across different platforms and products that utilize XStream (Oracle Advisory, Fedora Update).