CVE-2017-7957: Input Validation
A vulnerability was found in XStream. Parsing a maliciously crafted file could cause the application to crash.
The processed stream at unmarshalling type contains type information to recreate the formerly written objects. XStream creates therefore new instances based on these type information. The crash occurrs if this information advices XStream to create an instance of the primitive type 'void'. This situation can only happen if an attacker was able to manipulate the incoming data, since such an instance does not exist.
References:
http://seclists.org/oss-sec/2017/q2/9
Other sources
XStream is vulnerable to a denial of service, caused by the improper handling of attempts to create an instance of the primitive type 'void' during unmarshalling. A remote attacker could exploit this vulnerability to cause the application to crash.
— IBM
XStream through 1.4.9, when a certain denyTypes workaround is not used, mishandles attempts to create an instance of the primitive type 'void' during unmarshalling, leading to a remote application crash, as demonstrated by an xstream.fromXML("<void/>") call.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is CVE-2017-7957?
CVE-2017-7957 is a vulnerability in XStream through 1.4.9 that allows for a denial of service attack.
How does CVE-2017-7957 manifest?
CVE-2017-7957 manifests as a remote application crash when XStream mishandles attempts to create an instance of the primitive type 'void' during unmarshalling.
Which software products are affected by CVE-2017-7957?
CVE-2017-7957 affects IBM GDE version 3.0.0.2, Xstream Project Xstream up to version 1.4.9, and Debian Debian Linux versions 8.0 and 9.0.
What is the severity of CVE-2017-7957?
The severity of CVE-2017-7957 is high with a CVSS score of 7.5.
How can CVE-2017-7957 be mitigated?
To mitigate CVE-2017-7957, apply the denyTypes workaround in XStream 1.4.9 or upgrade to a version that includes the fix.