Security update for xstream

Announcement ID:	SUSE-SU-2021:1840-1
Rating:	important
References:	bsc#1184372 bsc#1184373 bsc#1184374 bsc#1184375 bsc#1184376 bsc#1184377 bsc#1184378 bsc#1184379 bsc#1184380 bsc#1184796 bsc#1184797
Cross-References:	CVE-2021-21341 CVE-2021-21342 CVE-2021-21343 CVE-2021-21344 CVE-2021-21345 CVE-2021-21346 CVE-2021-21347 CVE-2021-21348 CVE-2021-21349 CVE-2021-21350 CVE-2021-21351
CVSS scores:	CVE-2021-21341 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-21341 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-21342 ( SUSE ): 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N CVE-2021-21342 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N CVE-2021-21343 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N CVE-2021-21343 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVE-2021-21344 ( SUSE ): 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L CVE-2021-21344 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-21345 ( SUSE ): 8.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H CVE-2021-21345 ( NVD ): 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CVE-2021-21346 ( SUSE ): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-21346 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-21347 ( SUSE ): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-21347 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-21348 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-21348 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-21349 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2021-21349 ( NVD ): 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N CVE-2021-21350 ( SUSE ): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-21350 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-21351 ( SUSE ): 8.0 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H CVE-2021-21351 ( NVD ): 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Affected Products:	Development Tools Module 15-SP2 Development Tools Module 15-SP3 SUSE Linux Enterprise Desktop 15 SP2 SUSE Linux Enterprise Desktop 15 SP3 SUSE Linux Enterprise High Performance Computing 15 SP2 SUSE Linux Enterprise High Performance Computing 15 SP3 SUSE Linux Enterprise Real Time 15 SP2 SUSE Linux Enterprise Real Time 15 SP3 SUSE Linux Enterprise Server 15 SP2 SUSE Linux Enterprise Server 15 SP2 Business Critical Linux 15-SP2 SUSE Linux Enterprise Server 15 SP3 SUSE Linux Enterprise Server 15 SP3 Business Critical Linux 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15 SP2 SUSE Linux Enterprise Server for SAP Applications 15 SP3 SUSE Manager Proxy 4.1 SUSE Manager Proxy 4.2 SUSE Manager Retail Branch Server 4.1 SUSE Manager Retail Branch Server 4.2 SUSE Manager Server 4.1 SUSE Manager Server 4.1 Module 4.1 SUSE Manager Server 4.2

An update that solves 11 vulnerabilities can now be installed.

Description:

This update for xstream fixes the following issues:

• Upgrade to 1.4.16
• CVE-2021-21351: remote attacker to load and execute arbitrary code (bsc#1184796)
• CVE-2021-21349: SSRF can lead to a remote attacker to request data from internal resources (bsc#1184797)
• CVE-2021-21350: arbitrary code execution (bsc#1184380)
• CVE-2021-21348: remote attacker could cause denial of service by consuming maximum CPU time (bsc#1184374)
• CVE-2021-21347: remote attacker to load and execute arbitrary code from a remote host (bsc#1184378)
• CVE-2021-21344: remote attacker could load and execute arbitrary code from a remote host (bsc#1184375)
• CVE-2021-21342: server-side forgery (bsc#1184379)
• CVE-2021-21341: remote attacker could cause a denial of service by allocating 100% CPU time (bsc#1184377)
• CVE-2021-21346: remote attacker could load and execute arbitrary code (bsc#1184373)
• CVE-2021-21345: remote attacker with sufficient rights could execute commands (bsc#1184372)
• CVE-2021-21343: replace or inject objects, that result in the deletion of files on the local host (bsc#1184376)

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

• Development Tools Module 15-SP2
  zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP2-2021-1840=1
• Development Tools Module 15-SP3
  zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP3-2021-1840=1
• SUSE Manager Server 4.1 Module 4.1
  zypper in -t patch SUSE-SLE-Module-SUSE-Manager-Server-4.1-2021-1840=1

Package List:

• Development Tools Module 15-SP2 (noarch)
  • xstream-1.4.16-3.8.1
• Development Tools Module 15-SP3 (noarch)
  • xstream-1.4.16-3.8.1
• SUSE Manager Server 4.1 Module 4.1 (noarch)
  • xstream-1.4.16-3.8.1

References:

• https://www.suse.com/security/cve/CVE-2021-21341.html
• https://www.suse.com/security/cve/CVE-2021-21342.html
• https://www.suse.com/security/cve/CVE-2021-21343.html
• https://www.suse.com/security/cve/CVE-2021-21344.html
• https://www.suse.com/security/cve/CVE-2021-21345.html
• https://www.suse.com/security/cve/CVE-2021-21346.html
• https://www.suse.com/security/cve/CVE-2021-21347.html
• https://www.suse.com/security/cve/CVE-2021-21348.html
• https://www.suse.com/security/cve/CVE-2021-21349.html
• https://www.suse.com/security/cve/CVE-2021-21350.html
• https://www.suse.com/security/cve/CVE-2021-21351.html
• https://bugzilla.suse.com/show_bug.cgi?id=1184372
• https://bugzilla.suse.com/show_bug.cgi?id=1184373
• https://bugzilla.suse.com/show_bug.cgi?id=1184374
• https://bugzilla.suse.com/show_bug.cgi?id=1184375
• https://bugzilla.suse.com/show_bug.cgi?id=1184376
• https://bugzilla.suse.com/show_bug.cgi?id=1184377
• https://bugzilla.suse.com/show_bug.cgi?id=1184378
• https://bugzilla.suse.com/show_bug.cgi?id=1184379
• https://bugzilla.suse.com/show_bug.cgi?id=1184380
• https://bugzilla.suse.com/show_bug.cgi?id=1184796
• https://bugzilla.suse.com/show_bug.cgi?id=1184797