Denial of Service Vulnerability in libxstream-java: CVE-2024-47072
Summary
UBUNTU-CVE-2024-47072: XStream is a simple library to serialize objects to XML and back again. Affects libxstream-java versions 1.4.4-1 – 1.4.7-1ubuntu0.1+esm2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libxstream-java is a Java library that facilitates the serialization of objects to XML and vice versa. It is widely used for its simplicity and efficiency in handling XML data. However, it has been found to be vulnerable to a specific issue that can lead to application crashes under certain conditions, particularly when using the BinaryStreamDriver.
Vulnerability Detail
The vulnerability identified as CVE-2024-47072 allows a remote attacker to exploit the libxstream-java library by manipulating the input stream processed by the BinaryStreamDriver. This manipulation can cause a stack overflow error, resulting in a denial of service. The vulnerability arises from inadequate input validation, which fails to detect malicious alterations in the binary input stream. If exploited, it can lead to application termination, impacting service availability.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If upgrading is not immediately possible, users can implement a workaround by catching the StackOverflowError in the client code that calls XStream. Here is a sample code snippet:
try {
// Your code that uses XStream
} catch (StackOverflowError e) {
// Handle the error gracefully
System.out.println("Stack overflow detected: " + e.getMessage());
}
Conclusion
The CVE-2024-47072 vulnerability in libxstream-java poses a significant risk by allowing denial of service attacks through stack overflow errors. Users are strongly advised to upgrade to the patched version to ensure the security and stability of their applications. For those unable to upgrade immediately, implementing a workaround can help mitigate the risk.
See every vulnerability recorded for libxstream-java →
FAQ
CVE-2024-47072 is a vulnerability in the libxstream-java library that can lead to a denial of service due to stack overflow errors caused by manipulated input streams.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor for open-source vulnerabilities without requiring signup.
Exploiting this vulnerability can lead to application crashes, resulting in service unavailability and potential disruptions for users.
Yes, a patched version of libxstream-java is available. Users should upgrade to version 1.4.21-1 to mitigate the vulnerability.
If immediate upgrading is not possible, implement a workaround by catching StackOverflowError in your client code to handle potential crashes.
Related vulnerabilities
Recent vulnerabilities recorded for libxstream-java.
