Denial of service in XStream · CVE-2017-7957 · GitHub Advisory Database · GitHub

Denial of service in XStream

High severity GitHub Reviewed Published Jun 30, 2020 to the GitHub Advisory Database • Updated Jan 9, 2023

Package

com.thoughtworks.xstream:xstream (Maven)

Affected versions

< 1.4.10

Patched versions

1.4.10

Description

XStream through 1.4.9, when a certain denyTypes workaround is not used, mishandles attempts to create an instance of the primitive type 'void' during unmarshalling, leading to a remote application crash, as demonstrated by an xstream.fromXML("") call.

References

Reviewed Jun 30, 2020

Published to the GitHub Advisory Database Jun 30, 2020

Last updated Jan 9, 2023

Severity

High

7.5

/ 10

CVSS base metrics

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H