/
DirectorySecurity Advisories
Sign In
Security Advisories

CGA-qjhf-ghc9-w84f

Published

Last updated

https://images.chainguard.dev/security/CGA-qjhf-ghc9-w84f
Package

hadoop-fips-3.3.6

Repository

Chainguard

Latest Update
Pending upstream fix
Aliases
  • CVE-2021-21341
  • GHSA-2p3x-qw9c-25hh

Severity

Unknown

Summary

XStream can cause a Denial of Service.

Description

Impact

The vulnerability may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a payload resulting in a denial of service only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types.

Patches

If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.

Workarounds

See workarounds for the different versions covering all CVEs.

References

See full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for CVE-2021-21341.

Credits

The vulnerability was discovered and reported by threedr3am.

For more information

If you have any questions or comments about this advisory:

References

Updates


Safe Source for Open Sourceâ„¢
Media KitContact Us
© 2025 Chainguard. All Rights Reserved.
Private PolicyTerms of Use

Products

Chainguard ContainersChainguard LibrariesChainguard VMs