Skip to content
OpenAdvisories
Medium ALAS2-2024-2463 1 CVE

Moderate: woodstox-core security update (Amazon Linux 2)

Published Feb 15, 2024 · Updated Feb 19, 2024

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-40152: Those using Woodstox to parse XML data may be vulnerable to Denial of Service attacks (DOS) if DTD support is enabled. If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack.

Fixed packages 2

ReleasePackageFixed in
Amazon Linux · 2 woodstox-core 0:4.1.2-8.amzn2.0.1
Amazon Linux · 2 woodstox-core-javadoc 0:4.1.2-8.amzn2.0.1

Vulnerabilities 1

  • Medium 6.5
    CVE-2022-40152 EPSS 18%

    Stack Buffer Overflow in Woodstox

    Those using Woodstox to parse XML data may be vulnerable to Denial of Service attacks (DOS) if DTD support is enabled. If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effec…

    x-stream Woodstox libxstream-java sonarqube-10 Debian Ubuntu Wolfi Maven

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2022-40152.html