Denial of Service Vulnerability in libxstream-java: Stack Overflow Risk
Summary
DEBIAN-CVE-2024-47072: XStream is a simple library to serialize objects to XML and back again. Affects libxstream-java versions < 1.4.15-3+deb11u3. Fixed in 1.4.15-3+deb11u3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libxstream-java is a Java library that facilitates the serialization of objects to XML and vice versa. It is widely used in applications that require data interchange in XML format. The library's functionality includes converting Java objects into XML and reconstructing them back into objects. However, it has been found to be vulnerable to a specific issue when configured to use the BinaryStreamDriver, which can lead to severe application instability.
Vulnerability Detail
The vulnerability identified as DEBIAN-CVE-2024-47072 allows a remote attacker to exploit the BinaryStreamDriver configuration in libxstream-java. By manipulating the input stream, an attacker can trigger a stack overflow error, resulting in a denial of service. This vulnerability is particularly concerning as it can cause applications to terminate unexpectedly, impacting availability and reliability. The issue has been addressed in version 1.4.21 of the library, which now raises an InputManipulationException instead of allowing the stack overflow to occur.
How To Fix
Minimum fixed version
1.4.15-3+deb11u3
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libxstream-javaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, users can implement a workaround by catching the StackOverflowError in the client code that calls XStream when configured with the BinaryStreamDriver. This can be done using the following code snippet:
try {
// Code that uses XStream
} catch (StackOverflowError e) {
// Handle the error gracefully
System.err.println("Stack overflow detected: " + e.getMessage());
}
Conclusion
The vulnerability in libxstream-java poses a significant risk of denial of service due to stack overflow errors when using the BinaryStreamDriver. Users are strongly advised to upgrade to the latest patched versions to ensure application stability and security. Implementing the suggested workaround can provide temporary relief until an upgrade is feasible.
See every vulnerability recorded for libxstream-java →
FAQ
libxstream-java is a Java library used for serializing and deserializing Java objects to and from XML.
The vulnerability allows remote attackers to exploit the BinaryStreamDriver configuration, leading to a stack overflow and denial of service.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
You can catch the StackOverflowError in your client code as a temporary workaround until you can upgrade.
More information can be found in the official Debian CVE database at https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2024-47072.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for libxstream-java.
