CVE-2022-41966: XStream Denial of Service via stack overflow
First published: Tue Dec 27 2022(Updated: )
A flaw was found in the xstream package. This flaw allows an attacker to cause a denial of service by injecting recursive collections or maps, raising a stack overflow.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| IBM Security Verify Governance | <=10.0 | |
| Xstream Project Xstream | <1.4.20 | |
| redhat/jenkins | <0:2.401.1.1686831596-3.el8 | 0:2.401.1.1686831596-3.el8 |
| redhat/jenkins | <0:2.401.1.1685677065-1.el8 | 0:2.401.1.1685677065-1.el8 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.cve.org/CVERecord?id=CVE-2022-41966 https://nvd.nist.gov/vuln/detail/CVE-2022-41966 https://github.com/x-stream/xstream/security/advisories/GHSA-j563-grx4-pjpv
- https://bugzilla.redhat.com/show_bug.cgi?id=2170431
- https://access.redhat.com/errata/RHSA-2023:1286
- https://access.redhat.com/errata/RHSA-2023:2041
- https://access.redhat.com/errata/RHSA-2023:3663
- https://access.redhat.com/errata/RHSA-2023:1006
- https://access.redhat.com/errata/RHSA-2023:3954
- https://access.redhat.com/errata/RHSA-2023:3625
- https://access.redhat.com/errata/RHSA-2023:1177
- https://access.redhat.com/errata/RHSA-2023:2100
- https://access.redhat.com/security/cve/cve-2022-41966
- https://exchange.xforce.ibmcloud.com/vulnerabilities/243448
- https://www.ibm.com/support/pages/node/7047640 (Advisory)
- https://github.com/x-stream/xstream/security/advisories/GHSA-j563-grx4-pjpv
- https://x-stream.github.io/CVE-2022-41966.html
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2170627
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2170626
- https://access.redhat.com/errata/RHSA-2024:1353
Parent vulnerabilities
(Appears in the following advisories)
Frequently Asked Questions
What is CVE-2022-41966?
CVE-2022-41966 is a vulnerability in the xstream package that allows a remote attacker to cause a denial of service (DoS) by manipulating the processed input stream.
What is the severity of CVE-2022-41966?
The severity of CVE-2022-41966 is high, with a CVSS score of 8.2.
How can CVE-2022-41966 be exploited?
CVE-2022-41966 can be exploited by an attacker manipulating the input stream, causing a stack overflow error and terminating the application.
Which software versions are affected by CVE-2022-41966?
Versions prior to 1.4.20 of the xstream package and versions v1.0 - v1.8.2 of IBM Disconnected Log Collector are affected by CVE-2022-41966.
Where can I find more information about CVE-2022-41966?
You can find more information about CVE-2022-41966 on the CVE website (https://www.cve.org/CVERecord?id=CVE-2022-41966), the NVD website (https://nvd.nist.gov/vuln/detail/CVE-2022-41966), and the XStream GitHub page (https://github.com/x-stream/xstream/security/advisories/GHSA-j563-grx4-pjpv).
- collector/redhat-cve
- collector/ibm-support
- collector/nvd-index
- agent/type
- agent/softwarecombine
- agent/weakness
- agent/author
- agent/description
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2022-41966
- agent/software-canonical-lookup
- agent/references
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/last-modified-date
- agent/severity
- agent/tags
- agent/first-publish-date
- agent/event
- package-manager/redhat
- vendor/ibm
- canonical/ibm security verify governance
- version/ibm security verify governance/10.0
- vendor/xstream project
- canonical/xstream project xstream