CVE-2022-40152: Stack Buffer Overflow in Woodstox
A flaw was found in the FasterXML/woodstox package. This flaw allows an attacker to cause a denial of service (DoS) in its target via XML serialization. An attacker may benefit from the parser sending a malicious input that may cause a crash. This vulnerability is only relevant for users using the DTD parsing functionality.
Other sources
Those using FasterXML/woodstox to seralize XML data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack.
This vulnerability is only relevant for users making use of the DTD parsing functionality.
— GitHub
Those using Woodstox to parse XML data may be vulnerable to Denial of Service attacks (DOS) if DTD support is enabled. If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack.
Those using Xstream to serialize XML data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack.
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47434 https://github.com/x-stream/xstream/issues/304
— Red Hat
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2022-40152?
CVE-2022-40152 is a vulnerability that allows an attacker to cause a denial of service (DoS) in the FasterXML/woodstox package via XML serialization.
How does CVE-2022-40152 affect users?
Users using the woodstox-core package versions up to 6.4.0 or 5.4.0, jenkins version up to 2.387.3.1684911776-3.el8, or any version of eap7-woodstox-core or IBM Disconnected Log Collector up to v1.8.2 are affected by CVE-2022-40152.
How severe is CVE-2022-40152?
CVE-2022-40152 is considered high severity with a CVSS score of 7.
How can I fix CVE-2022-40152?
To fix CVE-2022-40152, update the affected software to version 6.4.0 for woodstox-core, 2.387.3.1684911776-3.el8 for jenkins, or a version higher than v1.8.2 for IBM Disconnected Log Collector.
Where can I find more information about CVE-2022-40152?
You can find more information about CVE-2022-40152 at the following references: [link1], [link2], [link3].