https://bugzilla.redhat.com/show_bug.cgi?id=2049783
Bug ID: 2049783 Summary: CVE-2021-43859 xstream: Injecting highly recursive collections or maps can cause a DoS Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team@redhat.com Reporter: gsuckevi@redhat.com CC: abenaiss@redhat.com, aileenc@redhat.com, alazarot@redhat.com, anstephe@redhat.com, aos-bugs@redhat.com, ataylor@redhat.com, bibryam@redhat.com, bmontgom@redhat.com, chazlett@redhat.com, didiksupriadi41@gmail.com, drieden@redhat.com, emingora@redhat.com, eparis@redhat.com, etirelli@redhat.com, fedoraproject.org@bluhm-de.com, ggaughan@redhat.com, gmalinko@redhat.com, hbraun@redhat.com, ibek@redhat.com, janstey@redhat.com, java-sig-commits@lists.fedoraproject.org, jburrell@redhat.com, jnethert@redhat.com, jochrist@redhat.com, jokerman@redhat.com, jolee@redhat.com, jrokos@redhat.com, jross@redhat.com, jschatte@redhat.com, jstastny@redhat.com, jwon@redhat.com, krathod@redhat.com, kverlaen@redhat.com, lkundrak@v3.sk, mizdebsk@redhat.com, mnovotny@redhat.com, nstielau@redhat.com, pantinor@redhat.com, pbhattac@redhat.com, pdelbell@redhat.com, pjindal@redhat.com, rguimara@redhat.com, rrajasek@redhat.com, spandura@redhat.com, sponnaga@redhat.com, tzimanyi@redhat.com Target Milestone: --- Classification: Other
XStream is an open source java library to serialize objects to XML and back again. Versions prior to 1.4.19 may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a payload resulting in a denial of service only by manipulating the processed input stream. XStream 1.4.19 monitors and accumulates the time it takes to add elements to collections and throws an exception if a set threshold is exceeded. Users are advised to upgrade as soon as possible. Users unable to upgrade may set the NO_REFERENCE mode to prevent recursion. See GHSA-rmr5-cpv2-vgjf for further details on a workaround if an upgrade is not possible.
References: https://github.com/x-stream/xstream/security/advisories/GHSA-rmr5-cpv2-vgjf https://x-stream.github.io/CVE-2021-43859.html
Upstream patch: https://github.com/x-stream/xstream/commit/e8e88621ba1c85ac3b8620337dd672e0c...
https://bugzilla.redhat.com/show_bug.cgi?id=2049783
Guilherme de Almeida Suckevicz gsuckevi@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |2049784
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=2049784 [Bug 2049784] CVE-2021-43859 xstream: Injecting highly recursive collections or maps can cause a DoS [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2049783
Guilherme de Almeida Suckevicz gsuckevi@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |2049785
--- Comment #1 from Guilherme de Almeida Suckevicz gsuckevi@redhat.com --- Created xstream tracking bugs for this issue:
Affects: fedora-all [bug 2049784]
https://bugzilla.redhat.com/show_bug.cgi?id=2049783
--- Comment #2 from juneau@redhat.com --- Removed deprecated services-migration-analytics from affects.
https://bugzilla.redhat.com/show_bug.cgi?id=2049783
--- Comment #3 from juneau@redhat.com --- Added services-managed-kafka to affects per manifest review. Marked affected/delegated for presence of affected code:
services-managed-kafka/mk-ci-cd/app-services-operator-midstream:cb87896/com.thoughtworks.xstream:xstream-1.4.16 https://gitlab.cee.redhat.com/mk-ci-cd/app-services-operator-midstream/blob/... services-managed-kafka/mk-ci-cd/kas-fleetshard-operator:b165510/com.thoughtworks.xstream:xstream-1.4.17 https://gitlab.cee.redhat.com/mk-ci-cd/kas-fleetshard/blob/production/pom.xm... services-managed-kafka/mk-ci-cd/kas-fleetshard-sync:b165510/com.thoughtworks.xstream:xstream-1.4.17 https://gitlab.cee.redhat.com/mk-ci-cd/kas-fleetshard/blob/production/pom.xm...
https://bugzilla.redhat.com/show_bug.cgi?id=2049783 Bug 2049783 depends on bug 2049784, which changed state.
Bug 2049784 Summary: CVE-2021-43859 xstream: Injecting highly recursive collections or maps can cause a DoS [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2049784
What |Removed |Added ---------------------------------------------------------------------------- Status|ON_QA |CLOSED Resolution|--- |ERRATA
https://bugzilla.redhat.com/show_bug.cgi?id=2049783
Ted Jongseok Won jwon@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Fixed In Version| |xstream 1.4.19
https://bugzilla.redhat.com/show_bug.cgi?id=2049783
amctagga@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |2058794, 2058793
https://bugzilla.redhat.com/show_bug.cgi?id=2049783
--- Comment #12 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat OpenShift Container Platform 3.11
Via RHSA-2022:1420 https://access.redhat.com/errata/RHSA-2022:1420
https://bugzilla.redhat.com/show_bug.cgi?id=2049783
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2022:1420
https://bugzilla.redhat.com/show_bug.cgi?id=2049783
--- Comment #13 from Product Security DevOps Team prodsec-dev@redhat.com --- This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):
https://access.redhat.com/security/cve/cve-2021-43859
https://bugzilla.redhat.com/show_bug.cgi?id=2049783
Product Security DevOps Team prodsec-dev@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Resolution|--- |ERRATA Last Closed| |2022-04-27 11:46:24
https://bugzilla.redhat.com/show_bug.cgi?id=2049783
--- Comment #14 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat Fuse 7.11
Via RHSA-2022:5532 https://access.redhat.com/errata/RHSA-2022:5532
https://bugzilla.redhat.com/show_bug.cgi?id=2049783
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2022:5532
https://bugzilla.redhat.com/show_bug.cgi?id=2049783
--- Comment #15 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
RHINT Camel-Q 2.7
Via RHSA-2022:5606 https://access.redhat.com/errata/RHSA-2022:5606
https://bugzilla.redhat.com/show_bug.cgi?id=2049783
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2022:5606
https://bugzilla.redhat.com/show_bug.cgi?id=2049783
Carl George 🤠 carl@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |2214450
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=2214450 [Bug 2214450] CVE-2021-43859 xstream: Injecting highly recursive collections or maps can cause a DoS [epel-8]
https://bugzilla.redhat.com/show_bug.cgi?id=2049783 Bug 2049783 depends on bug 2214450, which changed state.
Bug 2214450 Summary: CVE-2021-43859 xstream: Injecting highly recursive collections or maps can cause a DoS [epel-8] https://bugzilla.redhat.com/show_bug.cgi?id=2214450
What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Resolution|--- |ERRATA
java-sig-commits@lists.fedoraproject.org