Denial of Service Vulnerability in libxstream-java: Stack Overflow via BinaryStreamDriver
Summary
CVE-2024-47072: XStream is a simple library to serialize objects to XML and back again. Affects libxstream-java across 2 version ranges.
< 1.4.15-3+deb11u3
< bb838ce2269cac47433e31c77b2b236466e9f266
Fixed in 1.4.15-3+deb11u3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
XStream is a powerful library designed for serializing Java objects to XML and deserializing XML back into Java objects. It is widely used for its simplicity and flexibility in handling complex data structures. However, when configured to use the BinaryStreamDriver, it becomes susceptible to a specific vulnerability that can lead to application crashes.
Vulnerability Detail
The vulnerability identified as CVE-2024-47072 allows a remote attacker to exploit the BinaryStreamDriver configuration in XStream. By manipulating the input stream, an attacker can trigger a stack overflow error, resulting in a denial of service (DoS) condition. This issue arises from improper handling of binary input streams, which can lead to application instability and crashes. The vulnerability affects versions prior to 1.4.21, which has been patched to detect such manipulations and raise an InputManipulationException instead.
How To Fix
Minimum fixed version
1.4.15-3+deb11u3
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libxstream-javaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, users can implement a workaround by catching the StackOverflowError in the client code that calls XStream when configured with the BinaryStreamDriver. This can be done using a try-catch block as shown below:
try {
// Code that uses XStream
} catch (StackOverflowError e) {
// Handle the error gracefully
}
Conclusion
The CVE-2024-47072 vulnerability in the XStream library poses a significant risk of denial of service through stack overflow when using the BinaryStreamDriver. Users are strongly advised to upgrade to the patched version to mitigate this risk. For those unable to upgrade immediately, implementing a try-catch workaround can provide temporary relief.
See every vulnerability recorded for libxstream-java →
FAQ
CVE-2024-47072 is a vulnerability in the XStream library that can lead to a denial of service due to stack overflow when using the BinaryStreamDriver.
An attacker can exploit this vulnerability to crash your application, leading to service interruptions and potential data loss.
All versions prior to 1.4.21 are affected by this vulnerability.
Yes, XStream version 1.4.21 and later includes a patch that addresses this vulnerability.
You can use Vulert, which monitors open-source vulnerabilities in your software. By simply using a manifest file like package-lock.json, you can check for vulnerabilities without needing to install anything.
Related vulnerabilities
Recent vulnerabilities recorded for libxstream-java.
