csaf_certbund - wid-sec-w-2024-1631

WID-SEC-W-2024-1631

Vulnerability from csaf_certbund - Published: 2024-07-16 22:00 - Updated: 2024-07-16 22:00

Summary

Atlassian Jira Software: Schwachstelle ermöglicht Denial of Service

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung

Jira ist eine Webanwendung zur Softwareentwicklung.

Angriff

Ein entfernter anonymer Angreifer kann eine Schwachstelle in der Atlassian Jira Software ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen.

Betroffene Betriebssysteme

- Linux - MacOS X - Windows

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "mittel"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Jira ist eine Webanwendung zur Softwareentwicklung.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter anonymer Angreifer kann eine Schwachstelle in der Atlassian Jira Software ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Linux\n- MacOS X\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2024-1631 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-1631.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2024-1631 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-1631"
      },
      {
        "category": "external",
        "summary": "Jira Data Center and Server vom 2024-07-16",
        "url": "https://jira.atlassian.com/browse/JSWSERVER-25951"
      },
      {
        "category": "external",
        "summary": "Jira Service Management Data Center and Server vom 2024-07-16",
        "url": "https://jira.atlassian.com/browse/JSDSERVER-15436"
      },
      {
        "category": "external",
        "summary": "Atlassian Security Bulletin vom 2024-07-16",
        "url": "https://confluence.atlassian.com/security/security-bulletin-july-16-2024-1417150917.html"
      }
    ],
    "source_lang": "en-US",
    "title": "Atlassian Jira Software: Schwachstelle erm\u00f6glicht Denial of Service",
    "tracking": {
      "current_release_date": "2024-07-16T22:00:00.000+00:00",
      "generator": {
        "date": "2024-08-15T18:11:24.277+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.5"
        }
      },
      "id": "WID-SEC-W-2024-1631",
      "initial_release_date": "2024-07-16T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2024-07-16T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "Software Data Center and Server \u003c9.4.18",
                "product": {
                  "name": "Atlassian Jira Software Software Data Center and Server \u003c9.4.18",
                  "product_id": "T036173"
                }
              },
              {
                "category": "product_version_range",
                "name": "Software Data Center and Server \u003c9.8.0",
                "product": {
                  "name": "Atlassian Jira Software Software Data Center and Server \u003c9.8.0",
                  "product_id": "T036175"
                }
              },
              {
                "category": "product_version_range",
                "name": "Software Data Center and Server \u003c9.12.0",
                "product": {
                  "name": "Atlassian Jira Software Software Data Center and Server \u003c9.12.0",
                  "product_id": "T036176"
                }
              },
              {
                "category": "product_version_range",
                "name": "Service Management Data Center and Server \u003c5.4.18",
                "product": {
                  "name": "Atlassian Jira Software Service Management Data Center and Server \u003c5.4.18",
                  "product_id": "T036177"
                }
              },
              {
                "category": "product_version_range",
                "name": "Service Management Data Center and Server \u003c5.8.0",
                "product": {
                  "name": "Atlassian Jira Software Service Management Data Center and Server \u003c5.8.0",
                  "product_id": "T036178"
                }
              },
              {
                "category": "product_version_range",
                "name": "Service Management Data Center and Server \u003c5.12.0",
                "product": {
                  "name": "Atlassian Jira Software Service Management Data Center and Server \u003c5.12.0",
                  "product_id": "T036179"
                }
              }
            ],
            "category": "product_name",
            "name": "Jira Software"
          }
        ],
        "category": "vendor",
        "name": "Atlassian"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2022-41966",
      "notes": [
        {
          "category": "description",
          "text": "Es besteht eine Schwachstelle in der Atlassian Jira Software. Dieser Fehler besteht im Software- und Service Management Data Center und Server aufgrund einer xstream-Abh\u00e4ngigkeit. Ein entfernter, anonymer Angreifer kann diese Schwachstelle ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen."
        }
      ],
      "release_date": "2024-07-16T22:00:00.000+00:00",
      "title": "CVE-2022-41966"
    }
  ]
}

CVE-2022-41966 (GCVE-0-2022-41966)

Vulnerability from cvelistv5 – Published: 2022-12-27 23:07 – Updated: 2025-04-11 14:51

Summary

XStream serializes Java objects to XML and back again. Versions prior to 1.4.20 may allow a remote attacker to terminate the application with a stack overflow error, resulting in a denial of service only via manipulation the processed input stream. The attack uses the hash code implementation for collections and maps to force recursive hash calculation causing a stack overflow. This issue is patched in version 1.4.20 which handles the stack overflow and raises an InputManipulationException instead. A potential workaround for users who only use HashMap or HashSet and whose XML refers these only as default map or set, is to change the default implementation of java.util.Map and java.util per the code example in the referenced advisory. However, this implies that your application does not care about the implementation of the map and all elements are comparable.

Severity ?

8.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

CWE

CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
CWE-121 - Stack-based Buffer Overflow
CWE-502 - Deserialization of Untrusted Data

Assigner

GitHub_M

References

URL

Tags

	https://github.com/x-stream/xstream/security/advi…	x_refsource_CONFIRM
	https://x-stream.github.io/CVE-2022-41966.html	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	x-stream	xstream	Affected: < 1.4.20

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T12:56:39.097Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://security.netapp.com/advisory/ntap-20230216-0005/"
          },
          {
            "name": "https://github.com/x-stream/xstream/security/advisories/GHSA-j563-grx4-pjpv",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/x-stream/xstream/security/advisories/GHSA-j563-grx4-pjpv"
          },
          {
            "name": "https://x-stream.github.io/CVE-2022-41966.html",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://x-stream.github.io/CVE-2022-41966.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-41966",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-11T14:50:46.308543Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-11T14:51:09.642Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "xstream",
          "vendor": "x-stream",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.4.20"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "XStream serializes Java objects to XML and back again. Versions prior to 1.4.20 may allow a remote attacker to terminate the application with a stack overflow error, resulting in a denial of service only via manipulation the processed input stream. The attack uses the hash code implementation for collections and maps to force recursive hash calculation causing a stack overflow. This issue is patched in version 1.4.20 which handles the stack overflow and raises an InputManipulationException instead. A potential workaround for users who only use HashMap or HashSet and whose XML refers these only as default map or set, is to change the default implementation of java.util.Map and java.util per the code example in the referenced advisory. However, this implies that your application does not care about the implementation of the map and all elements are comparable."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-120",
              "description": "CWE-120: Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-121",
              "description": "CWE-121: Stack-based Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "CWE-502: Deserialization of Untrusted Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-12-27T23:07:54.048Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/x-stream/xstream/security/advisories/GHSA-j563-grx4-pjpv",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/x-stream/xstream/security/advisories/GHSA-j563-grx4-pjpv"
        },
        {
          "name": "https://x-stream.github.io/CVE-2022-41966.html",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://x-stream.github.io/CVE-2022-41966.html"
        }
      ],
      "source": {
        "advisory": "GHSA-j563-grx4-pjpv",
        "discovery": "UNKNOWN"
      },
      "title": "XStream Denial of Service via stack overflow "
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2022-41966",
    "datePublished": "2022-12-27T23:07:54.048Z",
    "dateReserved": "2022-09-30T16:38:28.949Z",
    "dateUpdated": "2025-04-11T14:51:09.642Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

WID-SEC-W-2024-1631

CVE-2022-41966 (GCVE-0-2022-41966)

Tags

Sightings

Nomenclature