[Bug 2134290] New: CVE-2022-40153 xstream: Xstream to serialise XML data was vulnerable to Denial of Service attacks

https://bugzilla.redhat.com/show_bug.cgi?id=2134290

Bug ID: 2134290
           Summary: CVE-2022-40153 xstream: Xstream to serialise XML data
                    was vulnerable to Denial of Service attacks
           Product: Security Response
          Hardware: All
                OS: Linux
            Status: NEW
         Component: vulnerability
          Keywords: Security
          Severity: medium
          Priority: medium
          Assignee: [e-mail]
          Reporter: [e-mail]
                CC: [e-mail],
                    [e-mail],
                    [e-mail],
                    [e-mail], [e-mail]
            Blocks: 2128414
  Target Milestone: ---
    Classification: Other

Those using Xstream to seralize XML data may be vulnerable to Denial of Service
attacks (DOS). If the parser is running on user supplied input, an attacker may
supply content that causes the parser to crash by stackoverflow. This effect
may support a denial of service attack.

https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49858
https://github.com/x-stream/xstream/issues/304

[Bug 2134290] CVE-2022-40153 xstream: Xstream to serialise XML data was vulnerable to Denial of Service attacks

https://bugzilla.redhat.com/show_bug.cgi?id=2134290

Patrick Del Bello  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
         Depends On|                            |2134301, 2134302

Referenced Bugs:

https://bugzilla.redhat.com/show_bug.cgi?id=2134301
[Bug 2134301] CVE-2022-40153 xstream: Xstream to serialise XML data was
vulnerable to Denial of Service attacks [epel-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2134302
[Bug 2134302] CVE-2022-40153 xstream: Xstream to serialise XML data was
vulnerable to Denial of Service attacks [fedora-all]

[Bug 2134290] CVE-2022-40153 xstream: Xstream to serialise XML data was vulnerable to Denial of Service attacks

https://bugzilla.redhat.com/show_bug.cgi?id=2134290

--- Comment #1 from Patrick Del Bello  ---
Created xstream tracking bugs for this issue:

Affects: epel-all [bug 2134301]
Affects: fedora-all [bug 2134302]

[Bug 2134290] CVE-2022-40153 xstream: Xstream to serialise XML data was vulnerable to Denial of Service attacks

https://bugzilla.redhat.com/show_bug.cgi?id=2134290

--- Comment #9 from Product Security DevOps Team  ---
This bug is now closed. Further updates for individual products will be
reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-40153

[Bug 2134290] CVE-2022-40153 xstream: Xstream to serialise XML data was vulnerable to Denial of Service attacks

https://bugzilla.redhat.com/show_bug.cgi?id=2134290

Product Security DevOps Team  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |CLOSED
         Resolution|---                         |NOTABUG
        Last Closed|                            |2022-12-07 16:33:28

[Bug 2134290] CVE-2022-40153 xstream: Xstream to serialise XML data was vulnerable to Denial of Service attacks

https://bugzilla.redhat.com/show_bug.cgi?id=2134290

Avinash Hanwate  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
         Depends On|                            |2162201

[Bug 2134290] CVE-2022-40153 xstream: Xstream to serialise XML data was vulnerable to Denial of Service attacks

https://bugzilla.redhat.com/show_bug.cgi?id=2134290

--- Comment #12 from errata-xmlrpc  ---
This issue has been addressed in the following products:

RHINT Camel-Q 2.13.2

Via RHSA-2023:0469 https://access.redhat.com/errata/RHSA-2023:0469

[Bug 2134290] CVE-2022-40153 xstream: Xstream to serialise XML data was vulnerable to Denial of Service attacks

https://bugzilla.redhat.com/show_bug.cgi?id=2134290

errata-xmlrpc  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
            Link ID|                            |Red Hat Product Errata
                   |                            |RHSA-2023:0469

[Bug 2134290] CVE-2022-40153 xstream: Xstream to serialise XML data was vulnerable to Denial of Service attacks

https://bugzilla.redhat.com/show_bug.cgi?id=2134290
Bug 2134290 depends on bug 2134302, which changed state.

Bug 2134302 Summary: CVE-2022-40153 xstream: Xstream to serialise XML data was vulnerable to Denial of Service attacks [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2134302

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |CLOSED
         Resolution|---                         |EOL

[Bug 2134290] CVE-2022-40153 xstream: Xstream to serialise XML data was vulnerable to Denial of Service attacks

https://bugzilla.redhat.com/show_bug.cgi?id=2134290
Bug 2134290 depends on bug 2134301, which changed state.

Bug 2134301 Summary: CVE-2022-40153 xstream: Xstream to serialise XML data was vulnerable to Denial of Service attacks [epel-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2134301

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |CLOSED
         Resolution|---                         |NOTABUG