Debian Bug report logs -
#1027754
libxstream-java: CVE-2022-41966
Reply or subscribe to this bug.
Toggle useless messages
Report forwarded
to debian-bugs-dist@lists.debian.org, carnil@debian.org, team@security.debian.org, Debian Java Maintainers <pkg-java-maintainers@lists.alioth.debian.org>
:
Bug#1027754
; Package src:libxstream-java
.
(Mon, 02 Jan 2023 20:09:03 GMT) (full text, mbox, link).
Acknowledgement sent
to Salvatore Bonaccorso <carnil@debian.org>
:
New Bug report received and forwarded. Copy sent to carnil@debian.org, team@security.debian.org, Debian Java Maintainers <pkg-java-maintainers@lists.alioth.debian.org>
.
(Mon, 02 Jan 2023 20:09:03 GMT) (full text, mbox, link).
Message #5 received at submit@bugs.debian.org (full text, mbox, reply):
Source: libxstream-java
Version: 1.4.19-1
Severity: important
Tags: security upstream
X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org>
Hi,
The following vulnerability was published for libxstream-java.
CVE-2022-41966[0]:
| XStream serializes Java objects to XML and back again. Versions prior
| to 1.4.20 may allow a remote attacker to terminate the application
| with a stack overflow error, resulting in a denial of service only via
| manipulation the processed input stream. The attack uses the hash code
| implementation for collections and maps to force recursive hash
| calculation causing a stack overflow. This issue is patched in version
| 1.4.20 which handles the stack overflow and raises an
| InputManipulationException instead. A potential workaround for users
| who only use HashMap or HashSet and whose XML refers these only as
| default map or set, is to change the default implementation of
| java.util.Map and java.util per the code example in the referenced
| advisory. However, this implies that your application does not care
| about the implementation of the map and all elements are comparable.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2022-41966
https://www.cve.org/CVERecord?id=CVE-2022-41966
[1] https://x-stream.github.io/CVE-2022-41966.html
[2] https://github.com/x-stream/xstream/security/advisories/GHSA-j563-grx4-pjpv
[3] https://github.com/x-stream/xstream/commit/e9151f221b4969fb15b1e946d5d61dcdd459a391
Regards,
Salvatore
Send a report that this bug log contains spam.
Debian bug tracking system administrator <owner@bugs.debian.org>.
Last modified:
Tue Jan 3 13:03:19 2023;
Machine Name:
buxtehude
Debian Bug tracking system
Debbugs is free software and licensed under the terms of the GNU
Public License version 2. The current version can be obtained
from https://bugs.debian.org/debbugs-source/.
Copyright © 1999 Darren O. Benham,
1997,2003 nCipher Corporation Ltd,
1994-97 Ian Jackson,
2005-2017 Don Armstrong, and many other contributors.