Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS0zZjdoLW1mNHEtdnJtNM4AAu5w

Denial of Service due to parser crash

Those using FasterXML/woodstox to seralize XML data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack.

This vulnerability is only relevant for users making use of the DTD parsing functionality.

Permalink: https://github.com/advisories/GHSA-3f7h-mf4q-vrm4
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0zZjdoLW1mNHEtdnJtNM4AAu5w
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: over 1 year ago
Updated: 10 months ago

CVSS Score: 6.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Identifiers: GHSA-3f7h-mf4q-vrm4, CVE-2022-40152
References:

• https://nvd.nist.gov/vuln/detail/CVE-2022-40152
• https://github.com/x-stream/xstream/issues/304
• https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47434
• https://github.com/FasterXML/woodstox/issues/157
• https://github.com/FasterXML/woodstox/issues/160
• https://github.com/FasterXML/woodstox/pull/159
• https://github.com/advisories/GHSA-3f7h-mf4q-vrm4

Repository: https://github.com/x-stream/xstream
Blast Radius: 21.3

Affected Packages