What it is
XStream contains a remote code execution vulnerability that allows an attacker to manipulate the processed input stream and replace or inject objects that result in the execution of a local command on the server. This vulnerability can affect multiple products, including but not limited to VMware Cloud Foundation.
What to do
Apply updates per vendor instructions.
Vendor notices and references
- www.vmware.com/security/advisories/VMSA-2022-0027.html, https://x-stream.github.io/CVE-202
- nvd.nist.gov/vuln/detail/CVE-2021-39144
Description and required action as published by CISA. Full record at NVD.