You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
CVE-2021-29505: The processed stream at unmarshalling time contains type information to recreate the formerly written objects. XStream creates therefore new instances based on these type information. An attacker can manipulate the processed input stream and replace or inject objects, that result in execution of a local command on the server.
The proposed solution is to upgrade xstream to version 1.4.17
The text was updated successfully, but these errors were encountered:
Credits: V3geB1rd, white hat hacker from Tencent Security Response Center found and reported the issue to XStream and provided the required information to reproduce it.
eureka/eureka-client/build.gradle
Line 10 in 4d1cc80
CVE-2021-29505: The processed stream at unmarshalling time contains type information to recreate the formerly written objects. XStream creates therefore new instances based on these type information. An attacker can manipulate the processed input stream and replace or inject objects, that result in execution of a local command on the server.
The proposed solution is to upgrade xstream to version 1.4.17
The text was updated successfully, but these errors were encountered: