REDHAT-BUG-2134290
First published: Thu Oct 13 2022(Updated: )
Those using Xstream to seralize XML data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack. <a href="https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49858">https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49858</a> <a href="https://github.com/x-stream/xstream/issues/304">https://github.com/x-stream/xstream/issues/304</a>
| Affected Software | Affected Version | How to fix |
|---|---|---|
| XStream |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49858
- https://github.com/x-stream/xstream/issues/304
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2134301
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2134302
- https://access.redhat.com/security/cve/cve-2022-40153
- https://access.redhat.com/errata/RHSA-2023:0469
- https://bugzilla.redhat.com/show_bug.cgi?id=2134290
Frequently Asked Questions
What is the severity of REDHAT-BUG-2134290?
The severity of REDHAT-BUG-2134290 is considered critical due to its potential for Denial of Service attacks.
How do I fix REDHAT-BUG-2134290?
To fix REDHAT-BUG-2134290, update to the latest version of Xstream where the vulnerability has been addressed.
Who is affected by REDHAT-BUG-2134290?
Users of Xstream that process user-supplied XML data are affected by REDHAT-BUG-2134290.
What type of attack is associated with REDHAT-BUG-2134290?
REDHAT-BUG-2134290 is associated with Denial of Service (DoS) attacks caused by stack overflow.
How can an attacker exploit REDHAT-BUG-2134290?
An attacker can exploit REDHAT-BUG-2134290 by supplying crafted XML data that triggers a stack overflow in the parser.
- agent/type
- agent/first-publish-date
- agent/last-modified-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2022-40153
- agent/source
- agent/severity
- agent/references
- agent/description
- agent/event
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/xstream
- canonical/xstream