CVE-2022-40155: High severity IBM Watson Studio on Cloud Pak for Data vulnerability
REJECT DO NOT USE THIS CANDIDATE NUMBER. Reason: This CVE has been rejected as it was incorrectly assigned. All references and descriptions in this candidate have been removed to prevent accidental usage.
Other sources
A flaw was found in the XStream package. This flaw allows an attacker to cause a denial of service (DoS) in its target via XML serialization.
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. Reason: This CVE has been rejected as it was incorrectly assigned. All references and descriptions in this candidate have been removed to prevent accidental usage.
— IBM
Those using Xstream to serialise XML data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stack overflow. This effect may support a denial of service attack.
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50428 https://github.com/x-stream/xstream/issues/304
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-40155?
CVE-2022-40155 is a vulnerability in the XStream package that allows an attacker to cause a denial of service by triggering a stack-based buffer overflow.
How does CVE-2022-40155 affect IBM Disconnected Log Collector?
CVE-2022-40155 affects IBM Disconnected Log Collector versions v1.0 to v1.8.2, allowing a remote authenticated attacker to crash the parser and cause a denial of service.
How severe is CVE-2022-40155?
CVE-2022-40155 has a severity rating of high.
How can an attacker exploit CVE-2022-40155?
An attacker can exploit CVE-2022-40155 by sending a specially-crafted XML data to trigger the stack-based buffer overflow and crash the parser.
What is the Common Weakness Enumeration (CWE) for CVE-2022-40155?
The CWEs associated with CVE-2022-40155 are CWE-787 (Out-of-bounds Write) and CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer).