CVE-2021-39141: 
Java vulnerability analysis and mitigation

XStream, a Java library used to serialize objects to XML and back again, was found to contain a critical vulnerability (CVE-2021-39141) that allows remote attackers to load and execute arbitrary code from a remote host by manipulating the processed input stream. The vulnerability was discovered in all versions up to and including 1.4.17, and was patched in version 1.4.18. Users who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types were not affected (XStream CVE).

The vulnerability exists in XStream's unmarshalling process where the stream contains type information to recreate previously written objects. During unmarshalling, XStream creates new instances based on this type information. An attacker can manipulate the input stream to replace or inject objects that result in execution of arbitrary code loaded from a remote server. The vulnerability has been assigned a CVSS v3.1 Base Score of 8.5 HIGH with the vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H (NetApp Advisory).

When successfully exploited, this vulnerability allows remote attackers to execute arbitrary code on the target system, potentially leading to complete system compromise. The impact includes potential disclosure of sensitive information, addition or modification of data, and system compromise (Debian Advisory).

The primary mitigation is to upgrade to XStream version 1.4.18 or later, which uses a whitelist by default instead of a blacklist approach. For users who cannot upgrade immediately, it is recommended to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 no longer uses a blacklist by default since it cannot be secured for general purpose (GitHub Advisory).

Multiple major organizations and Linux distributions responded to this vulnerability by releasing security advisories and patches, including Debian, Fedora, and NetApp. The vulnerability was considered significant enough to be included in Oracle's Critical Patch Updates (Oracle CPU).