Denial of Service due to parser crash

高 7.5CVE-2022-40152 · GHSA-3f7h-mf4q-vrm4 · 16/09/2022 公開 · 17/06/2026 更新

パッケージ	影響を受けるバージョン	修正済みバージョン
com.fasterxml.woodstox:woodstox-core Maven	`≥ 6.0.0, < 6.4.0< 5.4.0`	`6.4.05.4.0`
woodstox fasterxml	`≥ 6.0.0, < 6.4.0< 5.4.0`	`6.4.05.4.0`
xstream xstream	`< 1.4.20`	`1.4.20`

概要

Those using FasterXML/woodstox to seralize XML data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack.

This vulnerability is only relevant for users making use of the DTD parsing functionality.

NVD の説明

Those using Woodstox to parse XML data may be vulnerable to Denial of Service attacks (DOS) if DTD support is enabled. If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack.