CVE-2022-40152

Woodstox is a high-performance validating namespace-aware StAX-compliant (JSR-173) Open Source XML-processor written in Java. XML processor means that it handles both input (== parsing) and output (== writing, serialization)), as well as supporting tasks such as validation.

Security Fix(es):

Those using Woodstox to parse XML data may be vulnerable to Denial of Service attacks (DOS) if DTD support is enabled. If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack.(CVE-2022-40152)

Red Hat Lightwell has released com.fasterxml.woodstox:woodstox-core 6.2.2.rhlw-00004 with a backported security fix.

CVE-2022-40152: Stack Buffer Overflow in Woodstox

This patched artifact is a drop-in replacement for com.fasterxml.woodstox:woodstox-core 6.2.2 from Maven Central.

Red Hat Lightwell has released com.fasterxml.woodstox:woodstox-core 6.0.3.rhlw-00001 with a backported security fix.

CVE-2022-40152: Stack Buffer Overflow in Woodstox

This patched artifact is a drop-in replacement for com.fasterxml.woodstox:woodstox-core 6.0.3 from Maven Central.

Red Hat Lightwell has released com.fasterxml.woodstox:woodstox-core 5.0.3.rhlw-00001 with a backported security fix.

CVE-2022-40152: Stack Buffer Overflow in Woodstox

This patched artifact is a drop-in replacement for com.fasterxml.woodstox:woodstox-core 5.0.3 from Maven Central.

Those using Woodstox to parse XML data may be vulnerable to Denial of Service attacks (DOS) if DTD support is enabled. If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack.

TuxCare rebuilt com.fasterxml.woodstox:woodstox-core to address 1 CVE. Fixed in 5.0.3.tuxcare.

TuxCare rebuilt com.fasterxml.woodstox:woodstox-core to address 1 CVE. Fixed in 5.3.0-tuxcare.1.

TuxCare rebuilt com.fasterxml.woodstox:woodstox-core to address 1 CVE. Fixed in 6.0.1-tuxcare.1.

Those using Woodstox to parse XML data may be vulnerable to Denial of Service attacks (DOS) if DTD support is enabled. If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack.

Denial of service using crafted input. (CVE-2022-40152)

These are all security issues fixed in the jackson-dataformat-xml-2.15.2-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the woodstox-core-7.2.1-1.1 package on the GA media of openSUSE Tumbleweed.

This update fixes the following issues:

cobbler:

• Fix improper authorization (bsc#1197027, CVE-2022-0860)
• Prevent error when starting up logrotate.service (bsc#1188191)

drools:

• Deserialization of Untrusted Data: unsafe data deserialization in DroolsStreamUtils.java (bsc#1204879, CVE-2022-1415)

grafana-formula:

• Version 0.8.1
  • Fix Uyuni/SUMA dashboard names
• Version 0.8.0
  • Set dashboard names depending on project
  • Update dashboards to use new JSON schema
  • Fix PostgreSQL dashboard queries
  • Migrate deprecated panels to their current replacements
• Version 0.7.1
  • Fix default password field description (bsc#1203698)
  • Do not require default admin and password fields

inter-server-sync:

• Version 0.2.7
  • Do not update pillars table if it does not exists like in 4.2
• Version 0.2.6
  • Export package extra tags for complete debian repo metatdata (bsc#1206375)
  • Replace URLs in OS Images pillars when exporting and importing images
• Version 0.2.5
  • Correct error when importing without debug log level (bsc#1204699)

mgr-osad:

• Version 4.2.9-1
  • Updated logrotate configuration (bsc#1206470)

prometheus-formula:

• Version 0.7.0
  • Switch from basic authentication to TLS certificate client authentication for Blackbox exporter
  • Fix scheme label in clients targets configration
  • Add README.md

py27-compat-salt:

• Ignore extend declarations from excluded SLS files (bsc#1203886)
• Enhance capture of error messages for Zypper calls in zypperpkg module

rhnlib:

• Version 4.2.7-1
  • Don't get stuck at the end of SSL transfers (bsc#1204032)

saltboot-formula:

• Update to version 0.1.1676908681.e90e0b1
  • Add failsafe stop file when salt-minion does not stop (bsc#1208418)
  • Support salt bundle (bsc#1208499)

salt-netapi-client:

• Version 0.21.0
  • See: https://github.com/SUSE/salt-netapi-client/releases/tag/v0.21.0
• Add transactional_update module
• Improve logging when creating salt exception

smdba:

• Version 1.7.11
  • fix config update from wal_keep_segments to wal_keep_size for newer postgresql versions (bsc#1204519)

spacecmd:

• Version 4.2.21-1
  • Prevent string api parameters to be parsed as dates if not in ISO-8601 format (bsc#1205759)
  • Add python-dateutil dependency, required to process date values in spacecmd api calls
  • Correctly understand 'ssm' keyword on scap scheduling
  • Fix dict_keys not supporting indexing in systems_setconfigchannelorger

spacewalk-admin:

• Version 4.2.13-1
  • Generate uyuni_roster.conf with salt-secrets-config (bsc#1200096)

spacewalk-backend:

• Version 4.2.26-1
  • Fix reposync error about missing 'content-type' key when syncing certain channels
  • Compute headers as list of two-tuples to be used by url grabber (bsc#1205523)
  • Updated logrotate configuration (bsc#1206470)
  • Add 'octet-stream' to accepted content-types for reposync mirrorlists
  • Exclude invalid mirror urls for reposync (bsc#1203826)
  • do not fetch mirrorlist when a file url is given
  • Keep older module metadata files in database (bsc#1201893)
  • Removed the activation keys report from the debug information

spacewalk-certs-tools:

• Version 4.2.19-1
  • some i18n functions moved to new module which needs to be loaded (bsc#1201142)
  • Generated bootstrap scripts installs all needed Salt 3004 dependencies for Ubuntu 18.04 (bsc#1204517)

spacewalk-client-tools:

• Version 4.2.22-1
  • Update translation strings

spacewalk-java:

• Version 4.2.47-1
  • Use uyuni roster salt module instead of flat roster files (bsc#1200096)
• Version 4.2.46-1
  • Fix registration with proxy and tunnel SSH (bsc#1200096)
• Version 4.2.45-1
  • Add 'none' matcher to CLM AppStream filters (bsc#1206817)
  • Improve logs when sls action chain file is missing
  • Do not forward ssh command if proxy and tunnel are present (bsc#1200096)
  • Fix not being able to delete CLM environment if there are custom child channels that where not built by the environment…

This update for woodstox fixes the following issues:

• CVE-2022-40152: Fixed stack overflow in XML serialization (bsc#1203521).