Bug 2324606 (CVE-2024-47072)

Summary: CVE-2024-47072 com.thoughtworks.xstream: XStream is vulnerable to a Denial of Service attack due to stack overflow from a manipulated binary input stream
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: aazores, abrianik, adinn, adupliak, anstephe, aschwart, asoldano, ataylor, avibelli, bbaranow, bgeorges, bmaxwell, boliveir, brian.stansberry, ccranfor, cdewolf, chazlett, chfoley, clement.escoffier, cmah, cmiranda, dandread, darran.lofthouse, dhanak, dkreling, dosoudil, drichtar, drosa, eaguilar, ebaron, eric.wittmann, fjuma, fmariani, fmongiar, fzakkak, galder.zamarreno, ggrzybek, gmalinko, gsmet, ibek, istudens, ivassile, iweiss, janstey, jcantril, jkoops, jmartisk, jnethert, jolong, jpechane, jpoth, jrokos, jscholz, kverlaen, lgao, lthon, manderse, mbabacek, mnovotny, mosmerov, mposolda, msochure, msvehla, nipatil, nwallace, olubyans, pantinor, parichar, pbizzarr, pcongius, pdelbell, pdrozd, peholase, pesilva, pgallagh, pjindal, pmackay, probinso, pskopek, rguimara, rkubis, rmartinc, rojacob, rowaters, rruss, rstancel, rstepani, rsvoboda, saroy, sausingh, sbiarozk, sdouglas, sfroberg, sgehwolf, smaestri, ssilvert, sthorger, swoodman, tasato, tcunning, tom.jenkinson, tqvarnst, vmuzikar, yfang
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in the XStream library. A remote attacker may trigger a denial of service by manipulating the processed input stream when XStream is configured to use the BinaryStreamDriver. This issue may lead to the termination of the application.
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2024-11-08 13:48:03 UTC
XStream is a simple library to serialize objects to XML and back again. This vulnerability may allow a remote attacker to terminate the application with a stack overflow error resulting in a denial of service only by manipulating the processed input stream when XStream is configured to use the BinaryStreamDriver. XStream 1.4.21 has been patched to detect the manipulation in the binary input stream causing the the stack overflow and raises an InputManipulationException instead. Users are advised to upgrade. Users unable to upgrade may catch the StackOverflowError in the client code calling XStream if XStream is configured to use the BinaryStreamDriver.

Comment 1 errata-xmlrpc 2024-11-25 16:56:07 UTC
This issue has been addressed in the following products:

  Red Hat Data Grid

Via RHSA-2024:10214 https://access.redhat.com/errata/RHSA-2024:10214

Comment 5 errata-xmlrpc 2025-03-04 14:17:47 UTC
This issue has been addressed in the following products:

  OCP-Tools-4.16-RHEL-9

Via RHSA-2025:2219 https://access.redhat.com/errata/RHSA-2025:2219

Comment 6 errata-xmlrpc 2025-03-04 14:19:21 UTC
This issue has been addressed in the following products:

  OCP-Tools-4.13-RHEL-8

Via RHSA-2025:2222 https://access.redhat.com/errata/RHSA-2025:2222

Comment 7 errata-xmlrpc 2025-03-04 14:37:11 UTC
This issue has been addressed in the following products:

  OCP-Tools-4.17-RHEL-9

Via RHSA-2025:2218 https://access.redhat.com/errata/RHSA-2025:2218

Comment 8 errata-xmlrpc 2025-03-04 14:37:50 UTC
This issue has been addressed in the following products:

  OCP-Tools-4.15-RHEL-8

Via RHSA-2025:2220 https://access.redhat.com/errata/RHSA-2025:2220

Comment 9 errata-xmlrpc 2025-03-04 14:38:19 UTC
This issue has been addressed in the following products:

  OCP-Tools-4.14-RHEL-8

Via RHSA-2025:2221 https://access.redhat.com/errata/RHSA-2025:2221

Comment 10 errata-xmlrpc 2025-03-04 14:38:43 UTC
This issue has been addressed in the following products:

  OCP-Tools-4.12-RHEL-8

Via RHSA-2025:2223 https://access.redhat.com/errata/RHSA-2025:2223