REDHAT-BUG-2134289
First published: Thu Oct 13 2022(Updated: )
Those using Xstream to serialise XML data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stack overflow. This effect may support a denial of service attack. <a href="https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50428">https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50428</a> <a href="https://github.com/x-stream/xstream/issues/304">https://github.com/x-stream/xstream/issues/304</a>
| Affected Software | Affected Version | How to fix |
|---|---|---|
| XStream |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50428
- https://github.com/x-stream/xstream/issues/304
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2134299
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2134300
- https://access.redhat.com/security/cve/cve-2022-40155
- https://access.redhat.com/errata/RHSA-2023:0469
- https://bugzilla.redhat.com/show_bug.cgi?id=2134289
Frequently Asked Questions
What is the severity of REDHAT-BUG-2134289?
The severity of REDHAT-BUG-2134289 is considered high due to the potential for Denial of Service attacks.
How do I fix REDHAT-BUG-2134289?
To fix REDHAT-BUG-2134289, update to the latest version of the Xstream library that contains the security patch.
Who is affected by REDHAT-BUG-2134289?
Anyone using the Xstream library for XML data serialization is potentially affected by REDHAT-BUG-2134289.
What type of attack does REDHAT-BUG-2134289 involve?
REDHAT-BUG-2134289 involves a Denial of Service (DoS) attack due to stack overflow vulnerabilities.
How can attackers exploit REDHAT-BUG-2134289?
Attackers can exploit REDHAT-BUG-2134289 by supplying malicious XML content that can cause the parser to crash.
- agent/type
- agent/first-publish-date
- agent/last-modified-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2022-40155
- agent/source
- agent/references
- agent/severity
- agent/description
- agent/event
- agent/tags
- agent/softwarecombine
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/xstream
- canonical/xstream