[java-sig-commits] [Bug 2134290] New: CVE-2022-40153 xstream: Xstream to serialise XML data was vulnerable to Denial of Service attacks

https://bugzilla.redhat.com/show_bug.cgi?id=2134290

Bug ID: 2134290
           Summary: CVE-2022-40153 xstream: Xstream to serialise XML data
                    was vulnerable to Denial of Service attacks
           Product: Security Response
          Hardware: All
                OS: Linux
            Status: NEW
         Component: vulnerability
          Keywords: Security
          Severity: medium
          Priority: medium
          Assignee: [e-mail]
          Reporter: [e-mail]
                CC: [e-mail],
                    [e-mail],
                    [e-mail],
                    [e-mail], [e-mail]
            Blocks: 2128414
  Target Milestone: ---
    Classification: Other

Those using Xstream to seralize XML data may be vulnerable to Denial of Service
attacks (DOS). If the parser is running on user supplied input, an attacker may
supply content that causes the parser to crash by stackoverflow. This effect
may support a denial of service attack.

https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49858
https://github.com/x-stream/xstream/issues/304