REDHAT-BUG-2134292
First published: Thu Oct 13 2022(Updated: )
Those using Xstream to seralize XML data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack. <a href="https://github.com/x-stream/xstream/issues/304">https://github.com/x-stream/xstream/issues/304</a> <a href="https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47367">https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47367</a>
| Affected Software | Affected Version | How to fix |
|---|---|---|
| XStream |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/x-stream/xstream/issues/304
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47367
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2134305
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2134306
- https://access.redhat.com/errata/RHSA-2023:0469
- https://access.redhat.com/security/cve/cve-2022-40151
- https://access.redhat.com/errata/RHSA-2023:2100
- https://access.redhat.com/errata/RHSA-2023:3299
- https://access.redhat.com/errata/RHSA-2024:1353
- https://bugzilla.redhat.com/show_bug.cgi?id=2134292
Frequently Asked Questions
What is the severity of REDHAT-BUG-2134292?
The severity of REDHAT-BUG-2134292 is considered high as it may lead to Denial of Service attacks.
How do I fix REDHAT-BUG-2134292?
To fix REDHAT-BUG-2134292, ensure you update to the latest version of XStream that addresses this vulnerability.
What systems are affected by REDHAT-BUG-2134292?
The systems affected by REDHAT-BUG-2134292 are those using XStream for XML serialization.
What kind of attacks can be executed due to REDHAT-BUG-2134292?
REDHAT-BUG-2134292 can be exploited to perform Denial of Service attacks that cause the parser to crash.
Can user input trigger the vulnerability in REDHAT-BUG-2134292?
Yes, user supplied input can trigger the vulnerability in REDHAT-BUG-2134292, leading to potential crashes.
- agent/type
- agent/first-publish-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2022-40151
- agent/references
- agent/severity
- agent/last-modified-date
- agent/event
- agent/description
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/xstream
- canonical/xstream