CVE-2024-47072

XStream is a simple library to serialize objects to XML and back again. This vulnerability may allow a remote attacker to terminate the application with a stack overflow error resulting in a denial of service only by manipulating the processed input stream when XStream is configured to use the BinaryStreamDriver. XStream 1.4.21 has been patched to detect the manipulation in the binary input stream causing the the stack overflow and raises an InputManipulationException instead. Users are advised to upgrade. Users unable to upgrade may catch the StackOverflowError in the client code calling XStream if XStream is configured to use the BinaryStreamDriver.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/x-stream/xstream/commit/bb838ce2269cac47433e31c77b2b236466e9f266
https://github.com/x-stream/xstream/security/advisories/GHSA-hfq9-hggm-c56q
https://x-stream.github.io/CVE-2024-47072.html

Configurations

No configuration.

History

No history.

Information

Published : 2024-11-08 00:15

Updated : 2024-11-08 19:01

NVD link : CVE-2024-47072

Mitre link : CVE-2024-47072

CVE.ORG link : CVE-2024-47072

JSON object : View

Products Affected

No product.

CWE

CWE-121

Stack-based Buffer Overflow

CWE-502

Deserialization of Untrusted Data

{"id": "CVE-2024-47072", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2024-11-08T00:15:14.937", "references": [{"url": "https://github.com/x-stream/xstream/commit/bb838ce2269cac47433e31c77b2b236466e9f266", "source": "security-advisories@github.com"}, {"url": "https://github.com/x-stream/xstream/security/advisories/GHSA-hfq9-hggm-c56q", "source": "security-advisories@github.com"}, {"url": "https://x-stream.github.io/CVE-2024-47072.html", "source": "security-advisories@github.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-121"}, {"lang": "en", "value": "CWE-502"}]}], "descriptions": [{"lang": "en", "value": "XStream is a simple library to serialize objects to XML and back again. This vulnerability may allow a remote attacker to terminate the application with a stack overflow error resulting in a denial of service only by manipulating the processed input stream when XStream is configured to use the BinaryStreamDriver. XStream 1.4.21 has been patched to detect the manipulation in the binary input stream causing the the stack overflow and raises an InputManipulationException instead. Users are advised to upgrade. Users unable to upgrade may catch the StackOverflowError in the client code calling XStream if XStream is configured to use the BinaryStreamDriver."}, {"lang": "es", "value": "XStream es una librer\u00eda sencilla para serializar objetos en formato XML y viceversa. Esta vulnerabilidad puede permitir que un atacante remoto finalice la aplicaci\u00f3n con un error de desbordamiento de pila que resulte en una denegaci\u00f3n de servicio solo al manipular el flujo de entrada procesado cuando XStream est\u00e1 configurado para usar BinaryStreamDriver. Se ha aplicado un parche a XStream 1.4.21 para detectar la manipulaci\u00f3n en el flujo de entrada binario que causa el desbordamiento de pila y genera una InputManipulationException en su lugar. Se recomienda a los usuarios que actualicen la versi\u00f3n. Los usuarios que no puedan actualizar la versi\u00f3n pueden detectar el StackOverflowError en el c\u00f3digo del cliente que llama a XStream si XStream est\u00e1 configurado para usar BinaryStreamDriver."}], "lastModified": "2024-11-08T19:01:03.880", "sourceIdentifier": "security-advisories@github.com"}