Security update for xstream SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2023:1673-1 Final 1 1 2023-03-29T13:06:34Z current 2023-03-29T13:06:34Z 2023-03-29T13:06:34Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for xstream This update for xstream fixes the following issues: - CVE-2022-40151: Fixed stackoverflow in XML serialization (bsc#1203520). - CVE-2022-41966: Fixed denial of service via uncontrolled recursion during deserialization (bsc#1206729). - Upgrade to 1.4.20. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Image SLES15-SP3-Manager-4-2-Server-BYOS-Azure-2023-1673,Image SLES15-SP3-Manager-4-2-Server-BYOS-EC2-HVM-2023-1673,Image SLES15-SP3-Manager-4-2-Server-BYOS-GCE-2023-1673,Image SLES15-SP4-Manager-Server-4-3-BYOS-2023-1673,Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure-2023-1673,Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2-2023-1673,Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE-2023-1673,SUSE-2023-1673,SUSE-SLE-Module-Development-Tools-15-SP4-2023-1673,SUSE-SLE-Module-SUSE-Manager-Server-4.2-2023-1673,SUSE-SLE-Module-SUSE-Manager-Server-4.3-2023-1673,SUSE-SLE-Product-HPC-15-SP2-LTSS-2023-1673,SUSE-SLE-Product-HPC-15-SP3-ESPOS-2023-1673,SUSE-SLE-Product-HPC-15-SP3-LTSS-2023-1673,SUSE-SLE-Product-RT-15-SP3-2023-1673,SUSE-SLE-Product-SLES-15-SP2-LTSS-2023-1673,SUSE-SLE-Product-SLES-15-SP3-LTSS-2023-1673,SUSE-SLE-Product-SLES_SAP-15-SP2-2023-1673,SUSE-SLE-Product-SLES_SAP-15-SP3-2023-1673,SUSE-Storage-7-2023-1673,SUSE-Storage-7.1-2023-1673,openSUSE-SLE-15.4-2023-1673 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2023/suse-su-20231673-1/ Link for SUSE-SU-2023:1673-1 https://lists.suse.com/pipermail/sle-updates/2023-March/028475.html E-Mail link for SUSE-SU-2023:1673-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1203520 SUSE Bug 1203520 https://bugzilla.suse.com/1206729 SUSE Bug 1206729 https://www.suse.com/security/cve/CVE-2022-40151/ SUSE CVE CVE-2022-40151 page https://www.suse.com/security/cve/CVE-2022-41966/ SUSE CVE CVE-2022-41966 page Image SLES15-SP3-Manager-4-2-Server-BYOS-Azure Image SLES15-SP3-Manager-4-2-Server-BYOS-EC2-HVM Image SLES15-SP3-Manager-4-2-Server-BYOS-GCE Image SLES15-SP4-Manager-Server-4-3-BYOS Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2 Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE SUSE Enterprise Storage 7 SUSE Enterprise Storage 7.1 SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS SUSE Linux Enterprise Module for Development Tools 15 SP4 SUSE Linux Enterprise Real Time 15 SP3 SUSE Linux Enterprise Server 15 SP2-LTSS SUSE Linux Enterprise Server 15 SP3-LTSS SUSE Linux Enterprise Server for SAP Applications 15 SP2 SUSE Linux Enterprise Server for SAP Applications 15 SP3 SUSE Manager Server Module 4.2 SUSE Manager Server Module 4.3 openSUSE Leap 15.4 xstream-1.4.20-150200.3.25.1 xstream-benchmark-1.4.20-150200.3.25.1 xstream-javadoc-1.4.20-150200.3.25.1 xstream-parent-1.4.20-150200.3.25.1 xstream-1.4.20-150200.3.25.1 as a component of Image SLES15-SP3-Manager-4-2-Server-BYOS-Azure xstream-1.4.20-150200.3.25.1 as a component of Image SLES15-SP3-Manager-4-2-Server-BYOS-EC2-HVM xstream-1.4.20-150200.3.25.1 as a component of Image SLES15-SP3-Manager-4-2-Server-BYOS-GCE xstream-1.4.20-150200.3.25.1 as a component of Image SLES15-SP4-Manager-Server-4-3-BYOS xstream-1.4.20-150200.3.25.1 as a component of Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure xstream-1.4.20-150200.3.25.1 as a component of Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2 xstream-1.4.20-150200.3.25.1 as a component of Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE xstream-1.4.20-150200.3.25.1 as a component of SUSE Enterprise Storage 7 xstream-1.4.20-150200.3.25.1 as a component of SUSE Enterprise Storage 7.1 xstream-1.4.20-150200.3.25.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS xstream-1.4.20-150200.3.25.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS xstream-1.4.20-150200.3.25.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS xstream-1.4.20-150200.3.25.1 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP4 xstream-1.4.20-150200.3.25.1 as a component of SUSE Linux Enterprise Real Time 15 SP3 xstream-1.4.20-150200.3.25.1 as a component of SUSE Linux Enterprise Server 15 SP2-LTSS xstream-1.4.20-150200.3.25.1 as a component of SUSE Linux Enterprise Server 15 SP3-LTSS xstream-1.4.20-150200.3.25.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP2 xstream-1.4.20-150200.3.25.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP3 xstream-1.4.20-150200.3.25.1 as a component of SUSE Manager Server Module 4.2 xstream-1.4.20-150200.3.25.1 as a component of SUSE Manager Server Module 4.3 xstream-1.4.20-150200.3.25.1 as a component of openSUSE Leap 15.4 xstream-benchmark-1.4.20-150200.3.25.1 as a component of openSUSE Leap 15.4 xstream-javadoc-1.4.20-150200.3.25.1 as a component of openSUSE Leap 15.4 xstream-parent-1.4.20-150200.3.25.1 as a component of openSUSE Leap 15.4 Those using Xstream to seralize XML data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack. CVE-2022-40151 Image SLES15-SP3-Manager-4-2-Server-BYOS-Azure:xstream-1.4.20-150200.3.25.1 Image SLES15-SP3-Manager-4-2-Server-BYOS-EC2-HVM:xstream-1.4.20-150200.3.25.1 Image SLES15-SP3-Manager-4-2-Server-BYOS-GCE:xstream-1.4.20-150200.3.25.1 Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure:xstream-1.4.20-150200.3.25.1 Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2:xstream-1.4.20-150200.3.25.1 Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE:xstream-1.4.20-150200.3.25.1 Image SLES15-SP4-Manager-Server-4-3-BYOS:xstream-1.4.20-150200.3.25.1 SUSE Enterprise Storage 7.1:xstream-1.4.20-150200.3.25.1 SUSE Enterprise Storage 7:xstream-1.4.20-150200.3.25.1 SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:xstream-1.4.20-150200.3.25.1 SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:xstream-1.4.20-150200.3.25.1 SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:xstream-1.4.20-150200.3.25.1 SUSE Linux Enterprise Module for Development Tools 15 SP4:xstream-1.4.20-150200.3.25.1 SUSE Linux Enterprise Real Time 15 SP3:xstream-1.4.20-150200.3.25.1 SUSE Linux Enterprise Server 15 SP2-LTSS:xstream-1.4.20-150200.3.25.1 SUSE Linux Enterprise Server 15 SP3-LTSS:xstream-1.4.20-150200.3.25.1 SUSE Linux Enterprise Server for SAP Applications 15 SP2:xstream-1.4.20-150200.3.25.1 SUSE Linux Enterprise Server for SAP Applications 15 SP3:xstream-1.4.20-150200.3.25.1 SUSE Manager Server Module 4.2:xstream-1.4.20-150200.3.25.1 SUSE Manager Server Module 4.3:xstream-1.4.20-150200.3.25.1 openSUSE Leap 15.4:xstream-1.4.20-150200.3.25.1 openSUSE Leap 15.4:xstream-benchmark-1.4.20-150200.3.25.1 openSUSE Leap 15.4:xstream-javadoc-1.4.20-150200.3.25.1 openSUSE Leap 15.4:xstream-parent-1.4.20-150200.3.25.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20231673-1/ https://www.suse.com/security/cve/CVE-2022-40151.html CVE-2022-40151 https://bugzilla.suse.com/1203520 SUSE Bug 1203520 XStream serializes Java objects to XML and back again. Versions prior to 1.4.20 may allow a remote attacker to terminate the application with a stack overflow error, resulting in a denial of service only via manipulation the processed input stream. The attack uses the hash code implementation for collections and maps to force recursive hash calculation causing a stack overflow. This issue is patched in version 1.4.20 which handles the stack overflow and raises an InputManipulationException instead. A potential workaround for users who only use HashMap or HashSet and whose XML refers these only as default map or set, is to change the default implementation of java.util.Map and java.util per the code example in the referenced advisory. However, this implies that your application does not care about the implementation of the map and all elements are comparable. CVE-2022-41966 Image SLES15-SP3-Manager-4-2-Server-BYOS-Azure:xstream-1.4.20-150200.3.25.1 Image SLES15-SP3-Manager-4-2-Server-BYOS-EC2-HVM:xstream-1.4.20-150200.3.25.1 Image SLES15-SP3-Manager-4-2-Server-BYOS-GCE:xstream-1.4.20-150200.3.25.1 Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure:xstream-1.4.20-150200.3.25.1 Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2:xstream-1.4.20-150200.3.25.1 Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE:xstream-1.4.20-150200.3.25.1 Image SLES15-SP4-Manager-Server-4-3-BYOS:xstream-1.4.20-150200.3.25.1 SUSE Enterprise Storage 7.1:xstream-1.4.20-150200.3.25.1 SUSE Enterprise Storage 7:xstream-1.4.20-150200.3.25.1 SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:xstream-1.4.20-150200.3.25.1 SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:xstream-1.4.20-150200.3.25.1 SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:xstream-1.4.20-150200.3.25.1 SUSE Linux Enterprise Module for Development Tools 15 SP4:xstream-1.4.20-150200.3.25.1 SUSE Linux Enterprise Real Time 15 SP3:xstream-1.4.20-150200.3.25.1 SUSE Linux Enterprise Server 15 SP2-LTSS:xstream-1.4.20-150200.3.25.1 SUSE Linux Enterprise Server 15 SP3-LTSS:xstream-1.4.20-150200.3.25.1 SUSE Linux Enterprise Server for SAP Applications 15 SP2:xstream-1.4.20-150200.3.25.1 SUSE Linux Enterprise Server for SAP Applications 15 SP3:xstream-1.4.20-150200.3.25.1 SUSE Manager Server Module 4.2:xstream-1.4.20-150200.3.25.1 SUSE Manager Server Module 4.3:xstream-1.4.20-150200.3.25.1 openSUSE Leap 15.4:xstream-1.4.20-150200.3.25.1 openSUSE Leap 15.4:xstream-benchmark-1.4.20-150200.3.25.1 openSUSE Leap 15.4:xstream-javadoc-1.4.20-150200.3.25.1 openSUSE Leap 15.4:xstream-parent-1.4.20-150200.3.25.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20231673-1/ https://www.suse.com/security/cve/CVE-2022-41966.html CVE-2022-41966 https://bugzilla.suse.com/1206729 SUSE Bug 1206729