CVE-2022-41966: XStream Denial of Service via stack overflow
A flaw was found in the xstream package. This flaw allows an attacker to cause a denial of service by injecting recursive collections or maps, raising a stack overflow.
Other sources
XStream serializes Java objects to XML and back again. Versions prior to 1.4.20 may allow a remote attacker to terminate the application with a stack overflow error, resulting in a denial of service only via manipulation the processed input stream. The attack uses the hash code implementation for collections and maps to force recursive hash calculation causing a stack overflow. This issue is patched in version 1.4.20 which handles the stack overflow and raises an InputManipulationException instead. A potential workaround for users who only use HashMap or HashSet and whose XML refers these only as default map or set, is to change the default implementation of java.util.Map and java.util per the code example in the referenced advisory. However, this implies that your application does not care about the implementation of the map and all elements are comparable.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/jenkinsto a version that resolves this vulnerability.Fixed in 0:2.401.1.1686831596-3.el8 - Upgrade
Upgrade
redhat/jenkinsto a version that resolves this vulnerability.Fixed in 0:2.401.1.1685677065-1.el8 - Upgrade
Upgrade
redhat/xstreamto a version that resolves this vulnerability.Fixed in 1.4.20 - Upgrade
Upgrade
x-stream/xstreamto a version that resolves this vulnerability.Fixed in 1.4.20 - Configuration
For users who only use HashMap or HashSet and whose XML refers to these as default map/set, apply the workaround from the referenced advisory by changing the default implementation of java.util.Map and java.util.Set to the implementation shown in the advisory code example. Ensure your application does not rely on a specific map/set implementation and that all elements are comparable.
XStream Default implementation for java.util.Map and java.util.Set/Map/Set used by XML aliases = Change defaults per the referenced advisory code example (workaround: configure XStream to use default Map/Set implementations as shown, so recursive hash calculation is not triggered)
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2022-41966?
CVE-2022-41966 is a vulnerability in the xstream package that allows a remote attacker to cause a denial of service (DoS) by manipulating the processed input stream.
What is the severity of CVE-2022-41966?
The severity of CVE-2022-41966 is high, with a CVSS score of 8.2.
How can CVE-2022-41966 be exploited?
CVE-2022-41966 can be exploited by an attacker manipulating the input stream, causing a stack overflow error and terminating the application.
Which software versions are affected by CVE-2022-41966?
Versions prior to 1.4.20 of the xstream package and versions v1.0 - v1.8.2 of IBM Disconnected Log Collector are affected by CVE-2022-41966.
Where can I find more information about CVE-2022-41966?
You can find more information about CVE-2022-41966 on the CVE website (https://www.cve.org/CVERecord?id=CVE-2022-41966), the NVD website (https://nvd.nist.gov/vuln/detail/CVE-2022-41966), and the XStream GitHub page (https://github.com/x-stream/xstream/security/advisories/GHSA-j563-grx4-pjpv).