Bug 2316271 (CVE-2024-47554)

Summary:	CVE-2024-47554 apache-commons-io: Possible denial of service attack on untrusted input to XmlStreamReader
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	aazores, abrianik, adupliak, amctagga, anstephe, aoconnor, aschwart, asoldano, ataylor, avibelli, bbaranow, bgeorges, bihu, bmaxwell, bniver, boliveir, brian.stansberry, ccranfor, cdewolf, chfoley, clement.escoffier, cmah, cmiranda, csutherl, dandread, darran.lofthouse, dbruscin, dhanak, dkreling, dosoudil, drichtar, drosa, eaguilar, ebaron, ecerquei, eric.wittmann, fjuma, flucifre, fmariani, fmongiar, ggrzybek, gmalinko, gmeno, gsmet, ibek, istudens, ivassile, iweiss, janstey, jclere, jkoops, jmartisk, jnethert, jolong, jpechane, jpoth, jrokos, jross, jscholz, kvanderr, kverlaen, lgao, lthon, manderse, mbenjamin, mhackett, mnovotny, mosmerov, mposolda, msochure, msvehla, nipatil, nwallace, olubyans, pantinor, parichar, pbizzarr, pcongius, pdelbell, pdrozd, peholase, pesilva, pgallagh, pjindal, plodge, pmackay, porcelli, probinso, pskopek, rguimara, rkieley, rkubis, rmartinc, rowaters, rruss, rstancel, rstepani, rsvoboda, sausingh, sbiarozk, sfroberg, smaestri, sostapov, ssilvert, sthorger, swoodman, szappis, tasato, tcunning, tom.jenkinson, tqvarnst, vereddy, vmuzikar, wfink, yfang
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A vulnerability was found in the Apache Commons IO component in the org.apache.commons.io.input.XmlStreamReader class. Excessive CPU resource consumption can lead to a denial of service when an untrusted input is processed.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2316397, 2316398
Bug Blocks:

Description OSIDB Bzimport 2024-10-03 12:01:05 UTC

Uncontrolled Resource Consumption vulnerability in Apache Commons IO.

The org.apache.commons.io.input.XmlStreamReader class may excessively consume CPU resources when processing maliciously crafted input.


This issue affects Apache Commons IO: from 2.0 before 2.14.0.

Users are recommended to upgrade to version 2.14.0 or later, which fixes the issue.

Comment 1 errata-xmlrpc 2024-11-13 16:21:10 UTC

This issue has been addressed in the following products:

  Streams for Apache Kafka 2.8.0

Via RHSA-2024:9571 https://access.redhat.com/errata/RHSA-2024:9571

Comment 3 errata-xmlrpc 2025-03-05 20:59:23 UTC

This issue has been addressed in the following products:

  Streams for Apache Kafka 2.9.0

Via RHSA-2025:2416 https://access.redhat.com/errata/RHSA-2025:2416