CVE-2022-41966
published 2022-12-28CVE-2022-41966: XStream serializes Java objects to XML and back again. Versions prior to 1.4.20 may allow a remote attacker to terminate the application with a stack overflow…
PriorityP345high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
8.69%
94.5th percentile
XStream serializes Java objects to XML and back again. Versions prior to 1.4.20 may allow a remote attacker to terminate the application with a stack overflow error, resulting in a denial of service only via manipulation the processed input stream. The attack uses the hash code implementation for collections and maps to force recursive hash calculation causing a stack overflow. This issue is patched in version 1.4.20 which handles the stack overflow and raises an InputManipulationException instead. A potential workaround for users who only use HashMap or HashSet and whose XML refers these only as default map or set, is to change the default implementation of java.util.Map and java.util per the code example in the referenced advisory. However, this implies that your application does not care about the implementation of the map and all elements are comparable.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| atlassian | jira_service_management | — | — |
| debian | libxstream-java | < libxstream-java 1.4.20-1 (bookworm) | libxstream-java 1.4.20-1 (bookworm) |
| x-stream | xstream | < 1.4.20 | 1.4.20 |
| xstream | xstream | < 1.4.20 | 1.4.20 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
osv8.8HIGH
vendor_ubuntu8.5HIGH
vendor_debian8.2HIGH
vendor_redhat8.2HIGH
vendor_oracle7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Atlassian
CVE-2022-41966: DoS (Denial of Service) com.thoughtworks.xstream:xstream Dependency in Jira Service Management Data Center and Server
vendor_atlassian·2024-07-16·CVSS 5.7
CVE-2022-41966 [HIGH] CVE-2022-41966: DoS (Denial of Service) com.thoughtworks.xstream:xstream Dependency in Jira Service Management Data Center and Server
CVE-2022-41966: DoS (Denial of Service) com.thoughtworks.xstream:xstream Dependency in Jira Service Management Data Center and Server
DoS (Denial of Service) com.thoughtworks.xstream:xstream Dependency in Jira Service Management Data Center and Server
CVE: CVE-2022-41966
Affected products: Jira Service Management
Oracle
Oracle Oracle Commerce Risk Matrix: Endeca Application Controller (XStream) — CVE-2022-41966
vendor_oracle·2023-10-15·CVSS 7.5
CVE-2022-41966 [HIGH] Oracle Oracle Commerce Risk Matrix: Endeca Application Controller (XStream) — CVE-2022-41966
Oracle Oracle Commerce Risk Matrix: Endeca Application Controller (XStream) vulnerability
CVE: CVE-2022-41966
CVSS: 7.5
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpuoct2023 (OCT 2023)
Oracle
Oracle Oracle Communications Applications Risk Matrix: Pricing Updater (XStream) — CVE-2022-41966
vendor_oracle·2023-07-15·CVSS 7.5
CVE-2022-41966 [HIGH] Oracle Oracle Communications Applications Risk Matrix: Pricing Updater (XStream) — CVE-2022-41966
Oracle Oracle Communications Applications Risk Matrix: Pricing Updater (XStream) vulnerability
CVE: CVE-2022-41966
CVSS: 7.5
Protocol: TCP/IP
Remote exploit: Yes
Affected versions: Network
Advisory: cpujul2023 (JUL 2023)
Oracle
Oracle Oracle Communications Applications Risk Matrix: Security Component (XStream) — CVE-2022-41966
vendor_oracle·2023-04-15·CVSS 7.5
CVE-2022-41966 [HIGH] Oracle Oracle Communications Applications Risk Matrix: Security Component (XStream) — CVE-2022-41966
Oracle Oracle Communications Applications Risk Matrix: Security Component (XStream) vulnerability
CVE: CVE-2022-41966
CVSS: 7.5
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpuapr2023 (APR 2023)
Ubuntu
XStream vulnerabilities
vendor_ubuntu·2023-03-13·CVSS 8.5
CVE-2021-39141 [HIGH] XStream vulnerabilities
Title: XStream vulnerabilities
Summary: Several security issues were fixed in XStream.
Lai Han discovered that XStream incorrectly handled certain inputs.
If a user or an automated system were tricked into opening a specially crafted
input file, a remote attacker could possibly use this issue to cause a denial
of service. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS.
(CVE-2021-39140)
It was discovered that XStream incorrectly handled certain inputs. If
a user or an automated system were tricked into opening a specially crafted
input file, a remote attacker could possibly use this issue to execute
arbitrary code. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04
LTS. (CVE-2021-39139, CVE-2021-39141, CVE-2021-39144, CVE-2021-39145,
CVE-2021-39146, CVE-2021-39147
Red Hat
xstream: Denial of Service by injecting recursive collections or maps based on element's hash values raising a stack overflow
vendor_redhat·2022-12-28·CVSS 8.2
CVE-2022-41966 [HIGH] CWE-770 xstream: Denial of Service by injecting recursive collections or maps based on element's hash values raising a stack overflow
xstream: Denial of Service by injecting recursive collections or maps based on element's hash values raising a stack overflow
XStream serializes Java objects to XML and back again. Versions prior to 1.4.20 may allow a remote attacker to terminate the application with a stack overflow error, resulting in a denial of service only via manipulation the processed input stream. The attack uses the hash code implementation for collections and maps to force recursive hash calculation causing a stack overflow. This issue is patched in version 1.4.20 which handles the stack overflow and raises an InputManipulationException instead. A potential workaround for users who only use HashMap or HashSet and whose XML refers these only as default map or set, is to change the default implementation of java.u
Debian
CVE-2022-41966: libxstream-java - XStream serializes Java objects to XML and back again. Versions prior to 1.4.20 ...
vendor_debian·2022·CVSS 8.2
CVE-2022-41966 [HIGH] CVE-2022-41966: libxstream-java - XStream serializes Java objects to XML and back again. Versions prior to 1.4.20 ...
XStream serializes Java objects to XML and back again. Versions prior to 1.4.20 may allow a remote attacker to terminate the application with a stack overflow error, resulting in a denial of service only via manipulation the processed input stream. The attack uses the hash code implementation for collections and maps to force recursive hash calculation causing a stack overflow. This issue is patched in version 1.4.20 which handles the stack overflow and raises an InputManipulationException instead. A potential workaround for users who only use HashMap or HashSet and whose XML refers these only as default map or set, is to change the default implementation of java.util.Map and java.util per the code example in the referenced advisory. However, this implies that your application does not car
OSV
libxstream-java vulnerabilities
osv·2023-03-13·CVSS 8.8
CVE-2021-39140 [HIGH] libxstream-java vulnerabilities
libxstream-java vulnerabilities
Lai Han discovered that XStream incorrectly handled certain inputs.
If a user or an automated system were tricked into opening a specially crafted
input file, a remote attacker could possibly use this issue to cause a denial
of service. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS.
(CVE-2021-39140)
It was discovered that XStream incorrectly handled certain inputs. If
a user or an automated system were tricked into opening a specially crafted
input file, a remote attacker could possibly use this issue to execute
arbitrary code. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04
LTS. (CVE-2021-39139, CVE-2021-39141, CVE-2021-39144, CVE-2021-39145,
CVE-2021-39146, CVE-2021-39147, CVE-2021-39148, CVE-2021-39149,
CVE-2021-39151, CVE-20
GHSA
XStream can cause Denial of Service via stack overflow
ghsa·2022-12-29
CVE-2022-41966 [HIGH] CWE-120 XStream can cause Denial of Service via stack overflow
XStream can cause Denial of Service via stack overflow
### Impact
The vulnerability may allow a remote attacker to terminate the application with a stack overflow error resulting in a denial of service only by manipulating the processed input stream.
### Patches
XStream 1.4.20 handles the stack overflow and raises an InputManipulationException instead.
### Workarounds
The attack uses the hash code implementation for collections and maps to force recursive hash calculation causing a stack overflow. Following types of the Java runtime are affected:
- java.util.HashMap
- java.util.HashSet
- java.util.Hashtable
- java.util.LinkedHashMap
- java.util.LinkedHashSet
- Other third party collection implementations that use their element's hash code may also be affected
A simple solution is to c
OSV
XStream can cause Denial of Service via stack overflow
osv·2022-12-29
CVE-2022-41966 [HIGH] XStream can cause Denial of Service via stack overflow
XStream can cause Denial of Service via stack overflow
### Impact
The vulnerability may allow a remote attacker to terminate the application with a stack overflow error resulting in a denial of service only by manipulating the processed input stream.
### Patches
XStream 1.4.20 handles the stack overflow and raises an InputManipulationException instead.
### Workarounds
The attack uses the hash code implementation for collections and maps to force recursive hash calculation causing a stack overflow. Following types of the Java runtime are affected:
- java.util.HashMap
- java.util.HashSet
- java.util.Hashtable
- java.util.LinkedHashMap
- java.util.LinkedHashSet
- Other third party collection implementations that use their element's hash code may also be affected
A simple solution is to c
OSV
CVE-2022-41966: XStream serializes Java objects to XML and back again
osv·2022-12-28·CVSS 7.5
CVE-2022-41966 [HIGH] CVE-2022-41966: XStream serializes Java objects to XML and back again
XStream serializes Java objects to XML and back again. Versions prior to 1.4.20 may allow a remote attacker to terminate the application with a stack overflow error, resulting in a denial of service only via manipulation the processed input stream. The attack uses the hash code implementation for collections and maps to force recursive hash calculation causing a stack overflow. This issue is patched in version 1.4.20 which handles the stack overflow and raises an InputManipulationException instead. A potential workaround for users who only use HashMap or HashSet and whose XML refers these only as default map or set, is to change the default implementation of java.util.Map and java.util per the code example in the referenced advisory. However, this implies that your application does not car
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2022-12-28
Published