Remote Application Crash Vulnerability in libxstream-java: CVE-2017-7957
Summary
CVE-2017-7957: XStream through 1.4.9, when a certain denyTypes workaround is not used, mishandles attempts to create an instance of the primitive type 'void' during unmarshalling, leading to a remote application crash, as demonstrated... Affects libxstream-java across 3 version ranges.
< 1.4.9-2
< ce63733284dd6519d2f4ca03c6aa8a6caa328379
< f66bbea1b383e705988abf8d06ea9782a73f24d4
Fixed in 1.4.9-2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libxstream-java is a popular library used for serializing and deserializing Java objects to and from XML. It provides a simple and efficient way to convert Java objects into XML format and vice versa, making it widely used in various Java applications. However, versions prior to 1.4.9 are susceptible to a critical vulnerability that can lead to application crashes under specific conditions.
Vulnerability Detail
CVE-2017-7957 is a vulnerability in XStream through version 1.4.9, which mishandles the creation of an instance of the primitive type 'void' during unmarshalling. This occurs when the denyTypes workaround is not implemented, allowing an attacker to trigger a remote application crash by sending specially crafted XML data, such as an xstream.fromXML("<void/>") call. The vulnerability can lead to significant disruptions in service and potential data loss.
How To Fix
Minimum fixed version
1.4.9-2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libxstream-javaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, implement the denyTypes workaround in your application. This involves configuring XStream to deny the creation of certain types, including 'void'. Here is an example code snippet to apply the workaround:
XStream xstream = new XStream();
// Deny the 'void' type
xstream.denyTypes(new Class[] { void.class });
Conclusion
CVE-2017-7957 is a significant vulnerability in the libxstream-java library that can lead to remote application crashes. It is crucial for users of affected versions to upgrade to version 1.4.9-2 or later to ensure their applications remain secure. Implementing the denyTypes workaround can provide temporary relief until an upgrade is feasible.
See every vulnerability recorded for libxstream-java →
FAQ
CVE-2017-7957 is a vulnerability in the libxstream-java library that can cause remote application crashes due to mishandling of the 'void' type during XML unmarshalling.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor and alert for open-source vulnerabilities without needing to sign up.
Exploiting this vulnerability can lead to application crashes, service disruptions, and potential data loss, impacting the overall functionality of the affected software.
Yes, you can implement a workaround by denying the 'void' type in your XStream configuration, which can help mitigate the risk until an upgrade is possible.
The CVSS score for CVE-2017-7957 is 7.5, indicating a high severity level that requires prompt attention.
Related vulnerabilities
Recent vulnerabilities recorded for libxstream-java.
