CVE-2022-40151: Stack Buffer Overflow in xstream
Impact The vulnerability may allow a remote attacker to terminate the application with a stack overflow error resulting in a denial of service only by manipulating the processed input stream.
Patches XStream 1.4.20 handles the stack overflow and raises an InputManipulationException instead.
Workarounds The only solution is to catch the StackOverflowError in the client code calling XStream.
References See full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for CVE-2022-40151.
Credits The vulnerability was discovered and reported by Henry Lin of the Google OSS-Fuzz team.
For more information If you have any questions or comments about this advisory: Open an issue in XStream Contact us at XStream Google Group
Other sources
A flaw was found in the XStream package. This flaw allows an attacker to cause a denial of service (DoS) in its target via XML serialization.
Those using Xstream to seralize XML data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/jenkinsto a version that resolves this vulnerability.Fixed in 0:2.387.3.1684911776-3.el8 - Upgrade
Upgrade
maven/com.thoughtworks.xstream:xstreamto a version that resolves this vulnerability.Fixed in 1.4.20 - Upgrade
Upgrade
XStreamto a version that resolves this vulnerability.Fixed in 1.4.20 - Compensating control
Catch StackOverflowError in the client code calling XStream when processing user-supplied input.
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2022-40151?
CVE-2022-40151 is a vulnerability in the XStream package that allows an attacker to cause a denial of service (DOS) attack by crashing the parser with stack overflow.
Who is affected by CVE-2022-40151?
Users of XStream who are running the vulnerable version of the software are affected by CVE-2022-40151.
What is the severity of CVE-2022-40151?
CVE-2022-40151 has a severity rating of high.
How can an attacker exploit CVE-2022-40151?
An attacker can exploit CVE-2022-40151 by supplying content to the XStream parser that causes it to crash with a stack overflow, resulting in a denial of service attack.
How can I protect myself from CVE-2022-40151?
To protect yourself from CVE-2022-40151, update XStream to version 2.387.3.1684911776-3.el8 or later, as provided by Red Hat.