CVE:CVE-2021-43859
CNNVD:CNNVD-202201-2709
XStream是XStream（Xstream）团队的一个轻量级的、简单易用的开源Java类库，它主要用于将对象序列化成XML（JSON）或反序列化为对象。
XStream 存在资源管理错误漏洞，该漏洞允许远程攻击者可利用该漏洞根据CPU类型或此类负载的并行执行在目标系统上分配100%的CPU时间，导致仅通过操作已处理的输入流来拒绝服务。XStream 1.4.19监视并累积向集合添加元素所需的时间，并在超过设置的阈值时抛出异常。建议用户尽快升级。无法升级的用户可以设置NO REFERENCE模式以防止递归。
solution:Upgrade xstream_project xstream to a higher version than 1.4.19,and avoid the version (,1.4.19); Upgrade fedoraproject fedora to a higher version than 34,35,and avoid the version 34,35; Upgrade debian debian_linux to a higher version than 9.0,and avoid the version 9.0; Upgrade oracle commerce_guided_search to a higher version than 11.3.2,and avoid the version 11.3.2; Upgrade oracle communications_brm_-_elastic_charging_engine to a higher version than 12.0.0.4.6,12.0.0.5.0,and avoid the version (,12.0.0.4.6),12.0.0.5.0; Upgrade oracle communications_cloud_native_core_automated_test_suite to a higher version than 1.9.0,and avoid the version 1.9.0; Upgrade oracle communications_diameter_intelligence_hub to a higher version than 8.1.0,8.2.6,and avoid the version [8.0.0,8.1.0],[8.2.0,8.2.6]; Upgrade oracle communications_policy_management to a higher version than 12.6.0.0.0,and avoid the version 12.6.0.0.0; Upgrade oracle flexcube_private_banking to a higher version than 12.1.0,and avoid the version 12.1.0; Upgrade oracle retail_xstore_point_of_service to a higher version than 16.0.6,17.0.4,18.0.3,19.0.2,20.0.1,and avoid the version 16.0.6,17.0.4,18.0.3,19.0.2,20.0.1