GHSA-3mq5-fq9h-gj7j
Duplicate Advisory: Denial of Service due to parser crash
- Severity
- Low
- The publisher's own rating, not a CVSS score
- Exploit chance (EPSS)
- —
- No score published
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- —
- Not classified
- Fix
- None yet
- No fixed version published
Description
Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-f8cc-g7j8-xxpm. This link is maintained to preserve external references.
Original Description
Those using Xstream to seralize XML data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack.
Affected versions
Maven
| Package | Vulnerable | Fixed in |
|---|---|---|
| com.thoughtworks.xstream:xstream | <= 1.4.19 |
No fix yet |
How to fix
No fixed version has been published yet. Until one is, remove or replace the package, or turn off or isolate the affected feature. This page updates when a fix ships.
References
Advisories
Packages
Other links
Timeline
- Published
- Withdrawn
- Last updated by the source
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| CVE-2021-39144 XStream is vulnerable to a Remote Command Execution attack | High Known exploited | Also affects com.thoughtworks.xstream:xstream |
| GHSA-hfq9-hggm-c56q XStream is vulnerable to a Denial of Service attack due to stack overflow from a manipulated binary input stream | High | Also affects com.thoughtworks.xstream:xstream |
| GHSA-f8cc-g7j8-xxpm XStream can cause a Denial of Service by injecting deeply nested objects raising a stack overflow | High | Also affects com.thoughtworks.xstream:xstream |
| GHSA-j563-grx4-pjpv XStream can cause Denial of Service via stack overflow | High | Also affects com.thoughtworks.xstream:xstream |
| GHSA-rmr5-cpv2-vgjf Denial of Service by injecting highly recursive collections or maps in XStream | High | Also affects com.thoughtworks.xstream:xstream |
| GHSA-64xx-cq4q-mf44 XStream is vulnerable to an Arbitrary Code Execution attack | High | Also affects com.thoughtworks.xstream:xstream |
| GHSA-6wf9-jmg9-vxcc XStream can cause a Denial of Service | Medium | Also affects com.thoughtworks.xstream:xstream |
| GHSA-g5w6-mrj7-75h2 XStream is vulnerable to an Arbitrary Code Execution attack | High | Also affects com.thoughtworks.xstream:xstream |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor