Vulnerabilities disclosed in Woodstox library 

Issue date: 06-01-2023
Affects versions: 15.1, 14.7, 13.4

Security Issue ID

SECURITY-395

 

Affected Product Version(s)

15.1.4, 14.7.13, 13.4.21 and previous releases.

Severity 

High/Medium

Description

CVE-2022-40152  suppress

Those using Woodstox to parse XML data may be vulnerable to Denial of Service attacks (DOS) if DTD support is enabled. If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack.

CVSSv3:

• Base Score: HIGH (7.5)
• Vector:  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

 

CVE-2022-40153  suppress

Those using Xstream to seralize XML data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack.

CVSSv3:

• Base Score: HIGH (7.5)
• Vector:  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

 

Instructions

Customers are recommended to upgrade to the latest version. As of the time of writing, 15.2.0, 14.7.13 or 13.4.22.