GoogleOSV:GHSA-7HWC-46RM-65JHDenial of service in XStream
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
0.793 High
EPSS
Percentile
98.2%
XStream through 1.4.9, when a certain denyTypes workaround is not used, mishandles attempts to create an instance of the primitive type ‘void’ during unmarshalling, leading to a remote application crash, as demonstrated by an xstream.fromXML(“<void/>”) call.
References
www.debian.org/security/2017/dsa-3841
www.securityfocus.com/bid/100687
www.securitytracker.com/id/1039499
x-stream.github.io/CVE-2017-7957.html
access.redhat.com/errata/RHSA-2017:1832
access.redhat.com/errata/RHSA-2017:2888
access.redhat.com/errata/RHSA-2017:2889
exchange.xforce.ibmcloud.com/vulnerabilities/125800
github.com/x-stream/xstream
github.com/x-stream/xstream/commit/6e546ec366419158b1e393211be6d78ab9604ab
github.com/x-stream/xstream/commit/8542d02d9ac5d384c85f4b33d6c1888c53bd55d
github.com/x-stream/xstream/commit/b3570be2f39234e61f99f9a20640756ea71b1b4
nvd.nist.gov/vuln/detail/CVE-2017-7957
www-prd-trops.events.ibm.com/node/715749
Related
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
0.793 High
EPSS
Percentile
98.2%