The vulnerability of the XStream Java library for converting objects to XML or JSON format is related to stack overflow conditions. This allows an attacker to cause a service failure.

🗓️ 14 Sep 2023 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 3 Views

XStream XML/JSON conversion vulnerability causes stack and buffer overflows enabling remote service failure.

Reporter	Title	Published	Views	Family All 76
IBM Security Bulletins	Security Bulletin: Vulnerability in XStream affects IBM Process Mining . CVE-2022-40151	5 May 202314:36	–	ibm
IBM Security Bulletins	Security Bulletin: SPSS Collaboration and Deployment Services is affected by multiple vulnerabilities in Woodstox	19 Sep 202518:17	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Tivoli Business Service Manager is vulnerable to a denial of service attack due to FasterXML Woodstox	30 Apr 202321:15	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Data Risk Manager is affected by multiple vulnerabilities	7 Mar 202303:26	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Content Navigator may affect IBM Business Automation Workflow	23 Mar 202322:37	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Business Automation Manager Open Editions 8.0.5	30 Apr 202418:52	–	ibm
IBM Security Bulletins	Security Bulletin: Atlas eDiscovery Process Management is affected by a vulnerable xstream-1.4.17.jar	8 May 202308:40	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Storage Protect Client and IBM Storage Protect for Space Management are vulnerable to denial of service due to CVEs in XStream (woodstox) (CVE-2022-40151, CVE-2022-40152)	15 Nov 202313:42	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in XStream library affects IBM Engineering Test Management (ETM) (CVE-2022-40151)	29 Sep 202311:47	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar SIEM includes components with known vulnerabilities	6 Jul 202318:48	–	ibm

Vulners

Node

red_hat keycloakMatch22.0.1

OR

xstream xstreamRange≤1.4.19

Source	Link
bugs	www.bugs.chromium.org/p/oss-fuzz/issues/detail
github	www.github.com/x-stream/xstream/issues/304
vuldb	www.vuldb.com/ru/
web	www.web.nvd.nist.gov/view/vuln/detail

13 Sep 2024 00:00Current

6.9Medium risk

Vulners AI Score6.9

CVSS 36.5

CVSS 26.8

EPSS0.00993

XStream library Stack overflow Buffer overflow Remote service failure Object conversion