Bug 1206729 - (CVE-2022-41966) VUL-0: CVE-2022-41966: xstream: denial of service via uncontrolled recursion during deserialization
(CVE-2022-41966)
VUL-0: CVE-2022-41966: xstream: denial of service via uncontrolled recursion ...
Status: NEW
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
unspecified
Other Other
: P3 - Medium : Normal
: ---
Assigned To: Fridrich Strba
Security Team bot
https://smash.suse.de/issue/351961/
CVSSv3.1:SUSE:CVE-2022-41966:7.5:(AV:...
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2022-12-28 12:24 UTC by Carlos López
Modified: 2023-03-29 16:30 UTC (History)
3 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---
stoyan.manolov: needinfo? (fstrba)


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Carlos López 2022-12-28 12:24:29 UTC
CVE-2022-41966

XStream serializes Java objects to XML and back again. Versions prior to 1.4.20
may allow a remote attacker to terminate the application with a stack overflow
error, resulting in a denial of service only via manipulation the processed
input stream. The attack uses the hash code implementation for collections and
maps to force recursive hash calculation causing a stack overflow. This issue is
patched in version 1.4.20 which handles the stack overflow and raises an
InputManipulationException instead. A potential workaround for users who only
use HashMap or HashSet and whose XML refers these only as default map or set, is
to change the default implementation of java.util.Map and java.util per the code
example in the referenced advisory. However, this implies that your application
does not care about the implementation of the map and all elements are
comparable.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-41966
https://github.com/x-stream/xstream/security/advisories/GHSA-j563-grx4-pjpv
https://www.cve.org/CVERecord?id=CVE-2022-41966
http://www.cvedetails.com/cve/CVE-2022-41966/
https://x-stream.github.io/CVE-2022-41966.html
Comment 1 Carlos López 2022-12-28 12:24:57 UTC
Affected:
- SUSE:SLE-15-SP2:Update/xstream
- openSUSE:Factory/xstream

Fix:
https://github.com/x-stream/xstream/commit/e9151f221b4969fb15b1e946d5d61dcdd459a391
Comment 3 OBSbugzilla Bot 2023-03-17 13:45:05 UTC
This is an autogenerated message for OBS integration:
This bug (1206729) was mentioned in
https://build.opensuse.org/request/show/1072631 Factory / xstream
Comment 5 Maintenance Automation 2023-03-29 16:30:38 UTC
SUSE-SU-2023:1673-1: An update that solves two vulnerabilities can now be installed.

Category: security (important)
Bug References: 1203520, 1206729
CVE References: CVE-2022-40151, CVE-2022-41966
Sources used:
openSUSE Leap 15.4 (src): xstream-1.4.20-150200.3.25.1
Development Tools Module 15-SP4 (src): xstream-1.4.20-150200.3.25.1
SUSE Manager Server 4.2 Module 4.2 (src): xstream-1.4.20-150200.3.25.1
SUSE Manager Server 4.3 Module 4.3 (src): xstream-1.4.20-150200.3.25.1
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (src): xstream-1.4.20-150200.3.25.1
SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 (src): xstream-1.4.20-150200.3.25.1
SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (src): xstream-1.4.20-150200.3.25.1
SUSE Linux Enterprise Real Time 15 SP3 (src): xstream-1.4.20-150200.3.25.1
SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (src): xstream-1.4.20-150200.3.25.1
SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (src): xstream-1.4.20-150200.3.25.1
SUSE Linux Enterprise Server for SAP Applications 15 SP2 (src): xstream-1.4.20-150200.3.25.1
SUSE Linux Enterprise Server for SAP Applications 15 SP3 (src): xstream-1.4.20-150200.3.25.1
SUSE Enterprise Storage 7.1 (src): xstream-1.4.20-150200.3.25.1
SUSE Enterprise Storage 7 (src): xstream-1.4.20-150200.3.25.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.