High Severity Vulnerability in xstream-1.4.16.jar

[gdut-yy]

eureka/eureka-client/build.gradle

Line 10 in 4d1cc80

compile 'com.thoughtworks.xstream:xstream:1.4.16'

CVE-2021-29505: The processed stream at unmarshalling time contains type information to recreate the formerly written objects. XStream creates therefore new instances based on these type information. An attacker can manipulate the processed input stream and replace or inject objects, that result in execution of a local command on the server.

The proposed solution is to upgrade xstream to version 1.4.17

[ming1ing]

CVE-2021-29505 POC: http://x-stream.github.io/CVE-2021-29505.html

Credits: V3geB1rd, white hat hacker from Tencent Security Response Center found and reported the issue to XStream and provided the required information to reproduce it.

[troshko111]

Thanks for the report and for the fix, appreciate it.