CVE-2022-40154: High severity IBM Watson Studio on Cloud Pak for Data vulnerability
REJECT DO NOT USE THIS CANDIDATE NUMBER. Reason: This CVE has been rejected as it was incorrectly assigned. All references and descriptions in this candidate have been removed to prevent accidental usage.
Other sources
A flaw was found in the XStream package. This flaw allows an attacker to cause a denial of service (DoS) in its target.
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. Reason: This CVE has been rejected as it was incorrectly assigned. All references and descriptions in this candidate have been removed to prevent accidental usage.
— IBM
Those using Xstream to serialise XML data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stack overflow. This effect may support a denial of service attack.
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50393 https://github.com/x-stream/xstream/issues/304
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-40154?
CVE-2022-40154 is a vulnerability in the XStream package that allows a remote authenticated attacker to cause a denial of service by exploiting a stack-based buffer overflow.
What is the severity of CVE-2022-40154?
CVE-2022-40154 has a severity rating of high.
How does CVE-2022-40154 impact IBM Disconnected Log Collector?
IBM Disconnected Log Collector versions v1.0 to v1.8.2 are affected by CVE-2022-40154 and can be exploited to cause a denial of service condition.
Is there a fix for CVE-2022-40154?
A fix for CVE-2022-40154 may be available from the vendor. It is recommended to check with IBM for any available patches or updates.
Where can I find more information about CVE-2022-40154?
More information about CVE-2022-40154 can be found in the references provided: CVE-2022-40154 on Chromium Bug Tracker, XStream GitHub issue #304, and Red Hat Bugzilla #2128960.