CVE-2022-40151: Stack Buffer Overflow in xstream

Reference Links

• https://www.cve.org/CVERecord?id=CVE-2022-40151 https://nvd.nist.gov/vuln/detail/CVE-2022-40151
• https://bugzilla.redhat.com/show_bug.cgi?id=2134292
• https://access.redhat.com/errata/RHSA-2023:3299
• https://access.redhat.com/errata/RHSA-2023:2100
• https://access.redhat.com/errata/RHSA-2023:0469
• https://access.redhat.com/security/cve/cve-2022-40151
• https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47367
• https://github.com/x-stream/xstream/issues/304
• https://exchange.xforce.ibmcloud.com/vulnerabilities/236354
• https://www.ibm.com/support/pages/node/7042313 (Advisory)
• https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2134305
• https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2134306
• https://access.redhat.com/errata/RHSA-2024:1353

Parent vulnerabilities

(Appears in the following advisories)

• RHSA-2023:3299
• RHSA-2023:2100
• RHSA-2023:0469
• IBM-7042313

Frequently Asked Questions

• What is CVE-2022-40151?

  CVE-2022-40151 is a vulnerability in the XStream package that allows an attacker to cause a denial of service (DOS) attack by crashing the parser with stack overflow.

• Who is affected by CVE-2022-40151?

  Users of XStream who are running the vulnerable version of the software are affected by CVE-2022-40151.

• What is the severity of CVE-2022-40151?

  CVE-2022-40151 has a severity rating of high.

• How can an attacker exploit CVE-2022-40151?

  An attacker can exploit CVE-2022-40151 by supplying content to the XStream parser that causes it to crash with a stack overflow, resulting in a denial of service attack.

• How can I protect myself from CVE-2022-40151?

  To protect yourself from CVE-2022-40151, update XStream to version 2.387.3.1684911776-3.el8 or later, as provided by Red Hat.