CVE-2024-47072

CVSS V2 None CVSS V3 None
Description
XStream is a simple library to serialize objects to XML and back again. This vulnerability may allow a remote attacker to terminate the application with a stack overflow error resulting in a denial of service only by manipulating the processed input stream when XStream is configured to use the BinaryStreamDriver. XStream 1.4.21 has been patched to detect the manipulation in the binary input stream causing the the stack overflow and raises an InputManipulationException instead. Users are advised to upgrade. Users unable to upgrade may catch the StackOverflowError in the client code calling XStream if XStream is configured to use the BinaryStreamDriver.
Overview
  • CVE ID
  • CVE-2024-47072
  • Assigner
  • GitHub_M
  • Vulnerability Status
  • PUBLISHED
  • Published Version
  • 2024-11-07T23:38:52.978Z
  • Last Modified Date
  • 2024-11-07T23:38:52.978Z
Weakness Enumerations
CWE URL
CWE-121 http://cwe.mitre.org/data/definitions/121.html
CWE-502 http://cwe.mitre.org/data/definitions/502.html
References
Reference URL Reference Tags
https://github.com/x-stream/xstream/security/advisories/GHSA-hfq9-hggm-c56q x_refsource_CONFIRM
https://github.com/x-stream/xstream/commit/bb838ce2269cac47433e31c77b2b236466e9f266 x_refsource_MISC
https://x-stream.github.io/CVE-2024-47072.html x_refsource_MISC
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2024-47072
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-47072
History
Created Old Value New Value Data Type Notes
2024-11-08 13:21:04 Added to TrackCVE