REDHAT-BUG-2128959
First published: Thu Sep 22 2022(Updated: )
Those using Xstream to serialise XML data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stack overflow. This effect may support a denial of service attack. <a href="https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50393">https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50393</a> <a href="https://github.com/x-stream/xstream/issues/304">https://github.com/x-stream/xstream/issues/304</a>
| Affected Software | Affected Version | How to fix |
|---|---|---|
| XStream |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50393
- https://github.com/x-stream/xstream/issues/304
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2128960
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2128961
- https://access.redhat.com/errata/RHSA-2023:0469
- https://access.redhat.com/security/cve/cve-2022-40154
- https://bugzilla.redhat.com/show_bug.cgi?id=2128959
Frequently Asked Questions
What is the severity of REDHAT-BUG-2128959?
The severity of REDHAT-BUG-2128959 is categorized as high due to its potential for Denial of Service attacks.
How do I fix REDHAT-BUG-2128959?
To fix REDHAT-BUG-2128959, update your Xstream library to the latest version that contains the necessary security patches.
Who is affected by REDHAT-BUG-2128959?
Users of Xstream who are serializing XML data with user-supplied input are affected by REDHAT-BUG-2128959.
What kind of attack does REDHAT-BUG-2128959 facilitate?
REDHAT-BUG-2128959 facilitates Denial of Service attacks by exploiting stack overflow vulnerabilities in the XML parser.
Is there a workaround for REDHAT-BUG-2128959?
A potential workaround for REDHAT-BUG-2128959 is to restrict user input and validate XML content before processing.
- agent/type
- agent/first-publish-date
- agent/last-modified-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2022-40154
- agent/source
- agent/references
- agent/severity
- agent/description
- agent/event
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/xstream
- canonical/xstream