REDHAT-BUG-2134288
First published: Thu Oct 13 2022(Updated: )
Those using Xstream to seralize XML data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack. <a href="https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50841">https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50841</a> <a href="https://github.com/x-stream/xstream/issues/304">https://github.com/x-stream/xstream/issues/304</a>
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Moonlight |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50841
- https://github.com/x-stream/xstream/issues/304
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2134297
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2134298
- https://access.redhat.com/security/cve/cve-2022-40156
- https://access.redhat.com/errata/RHSA-2023:0469
- https://access.redhat.com/errata/RHSA-2023:2100
- https://access.redhat.com/errata/RHSA-2023:3641
- https://bugzilla.redhat.com/show_bug.cgi?id=2134288
Frequently Asked Questions
What is the severity of REDHAT-BUG-2134288?
The severity of REDHAT-BUG-2134288 is categorized as a Denial of Service vulnerability.
How do I fix REDHAT-BUG-2134288?
To fix REDHAT-BUG-2134288, ensure you are using a patched version of the Xstream library that addresses this vulnerability.
What does REDHAT-BUG-2134288 affect?
REDHAT-BUG-2134288 affects users of the Xstream library when handling user-supplied XML data.
Can REDHAT-BUG-2134288 lead to security breaches?
While REDHAT-BUG-2134288 primarily leads to Denial of Service attacks, it can indirectly impact application availability and user access.
Is there a workaround for REDHAT-BUG-2134288?
A potential workaround for REDHAT-BUG-2134288 is to avoid processing untrusted XML data with the vulnerable parser.
- agent/type
- agent/first-publish-date
- agent/last-modified-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2022-40156
- agent/source
- agent/references
- agent/severity
- agent/description
- agent/event
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/xstream
- canonical/moonlight