Security update for woodstox SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2023:0679-1 Final 1 1 2023-03-08T15:40:17Z current 2023-03-08T15:40:17Z 2023-03-08T15:40:17Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for woodstox This update for woodstox fixes the following issues: - CVE-2022-40152: Fixed stack overflow in XML serialization (bsc#1203521). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Image SLES15-SP4-Manager-Server-4-3-BYOS-2023-679,Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure-2023-679,Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2-2023-679,Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE-2023-679,SUSE-2023-679,SUSE-SLE-Module-SUSE-Manager-Server-4.3-2023-679 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2023/suse-su-20230679-1/ Link for SUSE-SU-2023:0679-1 https://lists.suse.com/pipermail/sle-security-updates/2023-March/013995.html E-Mail link for SUSE-SU-2023:0679-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1203521 SUSE Bug 1203521 https://www.suse.com/security/cve/CVE-2022-40152/ SUSE CVE CVE-2022-40152 page Image SLES15-SP4-Manager-Server-4-3-BYOS Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2 Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE SUSE Manager Server Module 4.3 woodstox-4.4.2-150400.3.6.1 woodstox-4.4.2-150400.3.6.1 as a component of Image SLES15-SP4-Manager-Server-4-3-BYOS woodstox-4.4.2-150400.3.6.1 as a component of Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure woodstox-4.4.2-150400.3.6.1 as a component of Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2 woodstox-4.4.2-150400.3.6.1 as a component of Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE woodstox-4.4.2-150400.3.6.1 as a component of SUSE Manager Server Module 4.3 Those using Woodstox to parse XML data may be vulnerable to Denial of Service attacks (DOS) if DTD support is enabled. If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack. CVE-2022-40152 Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure:woodstox-4.4.2-150400.3.6.1 Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2:woodstox-4.4.2-150400.3.6.1 Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE:woodstox-4.4.2-150400.3.6.1 Image SLES15-SP4-Manager-Server-4-3-BYOS:woodstox-4.4.2-150400.3.6.1 SUSE Manager Server Module 4.3:woodstox-4.4.2-150400.3.6.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20230679-1/ https://www.suse.com/security/cve/CVE-2022-40152.html CVE-2022-40152 https://bugzilla.suse.com/1203521 SUSE Bug 1203521