Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 542
Alerts This Week
Warning Icon 1 542

SUSE: 2021:1840-1 Important: Xstream Remote Code Execution

suse
Calendar Grey June 2, 2021
Scroller Suse
SUSE Vulnerability Patch Announcement for xstream, targeting severe vulnerabilities and outlining remediation steps for impacted components.
An update that fixes 11 vulnerabilities is now available

Summary

This update for xstream fixes the following issues: - Upgrade to 1.4.16 - CVE-2021-21351: remote attacker to load and execute arbitrary code (bsc#1184796) - CVE-2021-21349: SSRF can lead to a remote attacker to request data from internal resources (bsc#1184797) - CVE-2021-21350: arbitrary code execution (bsc#1184380) - CVE-2021-21348: remote attacker could cause denial of service by consuming maximum CPU time (bsc#1184374) - CVE-2021-21347: remote attacker to load and execute arbitrary code from a remote host (bsc#1184378) - CVE-2021-21344: remote attacker could load and execute arbitrary code from a remote host (bsc#1184375) - CVE-2021-21342: server-side forgery (bsc#1184379) - CVE-2021-21341: remote attacker could cause a denial of service by allocating 100% CPU time (bsc#1184377)

Topics%20covered

Topics Covered

security advisory denial of service remote code execution vulnerability SUSE Linux important update xstream

References

#1184372 #1184373 #1184374 #1184375 #1184376

#1184377 #1184378 #1184379 #1184380 #1184796

#1184797

Cross- CVE-2021-21341 CVE-2021-21342 CVE-2021-21343

CVE-2021-21344 CVE-2021-21345 CVE-2021-21346

CVE-2021-21347 CVE-2021-21348 CVE-2021-21349

CVE-2021-21350 CVE-2021-21351

CVSS scores:

CVE-2021-21341 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2021-21341 (SUSE): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2021-21342 (NVD) : 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CVE-2021-21342 (SUSE): 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

CVE-2021-21343 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CVE-2021-21343 (SUSE): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: SUSE-SU-2021:1840-1
Rating: important

Topics%20covered

Topics Covered

security advisory denial of service remote code execution vulnerability SUSE Linux important update xstream

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.