github.com
https://github.com/x-stream/xstream CVE-2024-47072
XStream is vulnerable to a Denial of Service attack due to stack overflow from a manipulated binary input stream
Description
XStream is a simple library to serialize objects to XML and back again. This vulnerability may allow a remote attacker to terminate the application with a stack overflow error resulting in a denial of service only by manipulating the processed input stream when XStream is configured to use the BinaryStreamDriver. XStream 1.4.21 has been patched to detect the manipulation in the binary input stream causing the the stack overflow and raises an InputManipulationException instead. Users are advised to upgrade. Users unable to upgrade may catch the StackOverflowError in the client code calling XStream if XStream is configured to use the BinaryStreamDriver.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationNone
AutomatableYes
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Nov 8, 2024 · Source: CVE List
Affected products and versions
2| Product | Source | Version range | Status |
|---|---|---|---|
x-streamBrowse x-stream / x-streamDefault status: unknown | CVE List | Before 1.4.21 | affected |
| < 1.4.21 | affected | ||
com.thoughtworks.xstream:xstreamBrowse Maven / com.thoughtworks.xstream:xstream | GitHub Advisory | Before 1.4.21 · Fixed in 1.4.21 | affected |
References
7github.com
https://github.com/x-stream/xstream/commit/bb838ce2269cac47433e31c77b2b236466e9f266 github.com
https://github.com/x-stream/xstream/commit/fdd9f7d3de0d7ccf2f9979bcd09fbf3e6a0c881a github.comConfirmation
https://github.com/x-stream/xstream/security/advisories/GHSA-hfq9-hggm-c56q lists.debian.org
https://lists.debian.org/debian-lts-announce/2024/12/msg00023.html nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2024-47072 x-stream.github.io
https://x-stream.github.io/CVE-2024-47072.html