Description

XStream serializes Java objects to XML and back again. Versions prior to 1.4.20 may allow a remote attacker to terminate the application with a stack overflow error, resulting in a denial of service only via manipulation the processed input stream. The attack uses the hash code implementation for collections and maps to force recursive hash calculation causing a stack overflow. This issue is patched in version 1.4.20 which handles the stack overflow and raises an InputManipulationException instead. A potential workaround for users who only use HashMap or HashSet and whose XML refers these only as default map or set, is to change the default implementation of java.util.Map and java.util per the code example in the referenced advisory. However, this implies that your application does not care about the implementation of the map and all elements are comparable.

Severity

 

CVSS Version 3.x CVSS Version 2.0

CVSS 3.x Severity and Metrics:

NIST: NVD

Base Score:  7.5 HIGH

Vector:  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CNA:  GitHub, Inc.

Base Score:  8.2 HIGH

Vector:  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

NVD Analysts use publicly available information to associate vector strings and CVSS scores. We also display any CVSS information provided within the CVE List from the CNA.

Note: It is possible that the NVD CVSS may not match that of the CNA. The most common reason for this is that publicly available information does not provide sufficient detail or that information simply was not available at the time the CVSS vector string was assigned.

CVSS 2.0 Severity and Metrics:

NIST: NVD

Base Score: N/A

NVD score not yet provided.

NVD Analysts use publicly available information to associate vector strings and CVSS scores. We also display any CVSS information provided within the CVE List from the CNA.

Note: NVD Analysts have not published a CVSS score for this CVE at this time. NVD Analysts use publicly available information at the time of analysis to associate CVSS vector strings.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

Hyperlink	Resource
https://github.com/x-stream/xstream/security/advisories/GHSA-j563-grx4-pjpv	Mitigation  Third Party Advisory
https://x-stream.github.io/CVE-2022-41966.html	Exploit  Vendor Advisory

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-502	Deserialization of Untrusted Data	GitHub, Inc.
CWE-120	Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')	GitHub, Inc.
CWE-121	Stack-based Buffer Overflow	GitHub, Inc.

Known Affected Software Configurations Switch to CPE 2.2

CPEs loading, please wait.

Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.

Change History

1 change records found show changes

Initial Analysis by NIST 1/06/2023 12:05:31 PM

Action	Type	Old Value	New Value
Added	CPE Configuration		OR *cpe:2.3:a:xstream_project:xstream:*:*:*:*:*:*:*:* versions up to (excluding) 1.4.20
Added	CVSS V3.1		NIST AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Changed	Reference Type	https://github.com/x-stream/xstream/security/advisories/GHSA-j563-grx4-pjpv No Types Assigned	https://github.com/x-stream/xstream/security/advisories/GHSA-j563-grx4-pjpv Mitigation, Third Party Advisory
Changed	Reference Type	https://x-stream.github.io/CVE-2022-41966.html No Types Assigned	https://x-stream.github.io/CVE-2022-41966.html Exploit, Vendor Advisory