Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

redhat логотип

CVE-2022-41966

Опубликовано: 28 дек. 2022
Источник: redhat
CVSS3: 7.5
EPSS Низкий

Описание

XStream serializes Java objects to XML and back again. Versions prior to 1.4.20 may allow a remote attacker to terminate the application with a stack overflow error, resulting in a denial of service only via manipulation the processed input stream. The attack uses the hash code implementation for collections and maps to force recursive hash calculation causing a stack overflow. This issue is patched in version 1.4.20 which handles the stack overflow and raises an InputManipulationException instead. A potential workaround for users who only use HashMap or HashSet and whose XML refers these only as default map or set, is to change the default implementation of java.util.Map and java.util per the code example in the referenced advisory. However, this implies that your application does not care about the implementation of the map and all elements are comparable.

A flaw was found in the xstream package. This flaw allows an attacker to cause a denial of service by injecting recursive collections or maps, raising a stack overflow.

Отчет

Red Hat Fuse 7 ships an affected version of XStream. No endpoint in any flavor of Fuse is accepting by default an unverified input stream passed directly to XStream unmarshaller. Documentation always recommend all the endpoints (TCP/UDP/HTTP(S)/other listeners) to have at least one layer of authentication/authorization and Fuse in general itself in particular has a lot of mechanisms to protect the endpoints. Red Hat Single Sign-On contains XStream as a transitive dependency from Infinispan and the same is not affected as NO_REFERENCE is in use.

Затронутые пакеты

ПлатформаПакетСостояниеРекомендацияРелиз
A-MQ Clients 2xstreamNot affected
Logging Subsystem for Red Hat OpenShiftopenshift-logging/elasticsearch6-rhel8Not affected
Red Hat AMQ Broker 7xstreamNot affected
Red Hat build of Apicurio Registry 2xstreamAffected
Red Hat build of Debezium 1xstreamNot affected
Red Hat Data Grid 8xstreamAffected
Red Hat Decision Manager 7xstreamAffected
Red Hat Enterprise Linux 7xstreamNot affected
Red Hat Integration Camel K 1xstreamAffected
Red Hat Integration Camel Quarkus 1xstreamAffected

Показывать по

Дополнительная информация

Статус:

Important
Дефект:
CWE-120
Дефект:
CWE-121
Дефект:
CWE-502
https://bugzilla.redhat.com/show_bug.cgi?id=2170431xstream: Denial of Service by injecting recursive collections or maps based on element's hash values raising a stack overflow

EPSS

Процентиль: 89%
0.04274
Низкий

7.5 High

CVSS3

Связанные уязвимости

CVSS3: 8.2
ubuntu
около 3 лет назад

XStream serializes Java objects to XML and back again. Versions prior to 1.4.20 may allow a remote attacker to terminate the application with a stack overflow error, resulting in a denial of service only via manipulation the processed input stream. The attack uses the hash code implementation for collections and maps to force recursive hash calculation causing a stack overflow. This issue is patched in version 1.4.20 which handles the stack overflow and raises an InputManipulationException instead. A potential workaround for users who only use HashMap or HashSet and whose XML refers these only as default map or set, is to change the default implementation of java.util.Map and java.util per the code example in the referenced advisory. However, this implies that your application does not care about the implementation of the map and all elements are comparable.

CVSS3: 8.2
nvd
около 3 лет назад

XStream serializes Java objects to XML and back again. Versions prior to 1.4.20 may allow a remote attacker to terminate the application with a stack overflow error, resulting in a denial of service only via manipulation the processed input stream. The attack uses the hash code implementation for collections and maps to force recursive hash calculation causing a stack overflow. This issue is patched in version 1.4.20 which handles the stack overflow and raises an InputManipulationException instead. A potential workaround for users who only use HashMap or HashSet and whose XML refers these only as default map or set, is to change the default implementation of java.util.Map and java.util per the code example in the referenced advisory. However, this implies that your application does not care about the implementation of the map and all elements are comparable.

CVSS3: 8.2
debian
около 3 лет назад

XStream serializes Java objects to XML and back again. Versions prior ...

CVSS3: 8.2
github
около 3 лет назад

XStream can cause Denial of Service via stack overflow

CVSS3: 7.5
fstec
около 3 лет назад

Уязвимость Java-библиотеки для преобразования объектов в XML или JSON формат XStream платформы виртуализации VMware Cloud Foundation, связанная с переполнением буфера на стеке, позволяющая нарушителю вызвать отказ в обслуживании

EPSS

Процентиль: 89%
0.04274
Низкий

7.5 High

CVSS3