Bug 2134292 (CVE-2022-40151)

Summary:	CVE-2022-40151 xstream: Xstream to serialise XML data was vulnerable to Denial of Service attacks
Product:	[Other] Security Response	Reporter:	Patrick Del Bello <pdelbell>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	abenaiss, aileenc, alazarot, anstephe, asoldano, ataylor, avibelli, balejosg, bbaranow, bbuckingham, bcourt, bgeorges, bmaxwell, brian.stansberry, btotty, cdewolf, chazlett, clement.escoffier, dandread, darran.lofthouse, didiksupriadi41, dkreling, dosoudil, ehelms, emingora, eric.wittmann, etirelli, fedoraproject.org, fjuma, fmongiar, gjospin, gmalinko, gsmet, hamadhan, ibek, iweiss, janstey, java-sig-commits, jcantril, jnethert, jochrist, jpavlik, jpechane, jpoth, jrokos, jross, jscholz, jsherril, jwon, kverlaen, lgao, lkundrak, lthon, lzap, mhulan, mizdebsk, mmccune, mmclaugh, mnovotny, mokumar, mosmerov, msochure, msvehla, myarboro, nmoumoul, nwallace, orabin, pantinor, pcreech, pdelbell, peholase, periklis, pgallagh, pjindal, pmackay, probinso, rchan, rguimara, rkieley, rrajasek, rruss, rstancel, rsvoboda, sbiarozk, sdouglas, smaestri, tcunning, tom.jenkinson, yfang
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the XStream package. This flaw allows an attacker to cause a denial of service (DoS) in its target via XML serialization.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2023-01-28 20:22:18 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2134305, 2134306, 2162204
Bug Blocks:	2128414

Description Patrick Del Bello 2022-10-13 06:10:57 UTC

Those using Xstream to seralize XML data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack.

https://github.com/x-stream/xstream/issues/304
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47367

Comment 1 Patrick Del Bello 2022-10-13 06:27:51 UTC

Created xstream tracking bugs for this issue:

Affects: epel-all [bug 2134305]
Affects: fedora-all [bug 2134306]

Comment 12 errata-xmlrpc 2023-01-26 09:42:39 UTC

This issue has been addressed in the following products:

  RHINT Camel-Q 2.13.2

Via RHSA-2023:0469 https://access.redhat.com/errata/RHSA-2023:0469

Comment 13 Product Security DevOps Team 2023-01-28 20:22:12 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-40151

Comment 15 errata-xmlrpc 2023-05-03 14:06:00 UTC

This issue has been addressed in the following products:

  RHINT Camel-Springboot 3.20.1

Via RHSA-2023:2100 https://access.redhat.com/errata/RHSA-2023:2100

Comment 16 errata-xmlrpc 2023-05-24 17:10:47 UTC

This issue has been addressed in the following products:

  OpenShift Developer Tools and Services for OCP 4.13

Via RHSA-2023:3299 https://access.redhat.com/errata/RHSA-2023:3299

Comment 18 errata-xmlrpc 2024-03-18 09:47:59 UTC

This issue has been addressed in the following products:

  RHPAM 7.13.5 async

Via RHSA-2024:1353 https://access.redhat.com/errata/RHSA-2024:1353