XStream can cause a Denial of Service by injecting deeply nested objects raising a stack overflow

🗓️ 30 Dec 2022 16:58:39Reported by GitHub Advisory DatabaseType

github

github🔗 github.com👁 81 Views

XStream vulnerability results in stack overflow Do

Reporter	Title	Published	Views	Family All 74
IBM Security Bulletins	Security Bulletin: Vulnerability in XStream affects IBM Process Mining . CVE-2022-40151	5 May 202314:36	–	ibm
IBM Security Bulletins	Security Bulletin: SPSS Collaboration and Deployment Services is affected by multiple vulnerabilities in Woodstox	19 Sep 202518:17	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Tivoli Business Service Manager is vulnerable to a denial of service attack due to FasterXML Woodstox	30 Apr 202321:15	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Data Risk Manager is affected by multiple vulnerabilities	7 Mar 202303:26	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Content Navigator may affect IBM Business Automation Workflow	23 Mar 202322:37	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Business Automation Manager Open Editions 8.0.5	30 Apr 202418:52	–	ibm
IBM Security Bulletins	Security Bulletin: Atlas eDiscovery Process Management is affected by a vulnerable xstream-1.4.17.jar	8 May 202308:40	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Storage Protect Client and IBM Storage Protect for Space Management are vulnerable to denial of service due to CVEs in XStream (woodstox) (CVE-2022-40151, CVE-2022-40152)	15 Nov 202313:42	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in XStream library affects IBM Engineering Test Management (ETM) (CVE-2022-40151)	29 Sep 202311:47	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar SIEM includes components with known vulnerabilities	6 Jul 202318:48	–	ibm

Vulners

Node

com.thoughtworks.xstream xstreamRange<1.4.20maven

Source	Link
github	www.github.com/x-stream/xstream/security/advisories/GHSA-f8cc-g7j8-xxpm
nvd	www.nvd.nist.gov/vuln/detail/CVE-2022-40151
github	www.github.com/x-stream/xstream/issues/304
github	www.github.com/x-stream/xstream/issues/314
bugs	www.bugs.chromium.org/p/oss-fuzz/issues/detail
x-stream	www.x-stream.github.io/CVE-2022-40151.html
github	www.github.com/advisories/GHSA-f8cc-g7j8-xxpm

07 Jan 2023 05:05Current

7.7High risk

Vulners AI Score7.7

CVSS 3.16.5 - 7.5

EPSS0.00258

SSVC

CWE-121 CWE-502 CWE-787

xstream vulnerability stack overflow dos remote attacker inputmanipulationexception stackoverflowerror cve-2022-40151 google oss-fuzz