Vulnerability Details : CVE-2017-7957
XStream through 1.4.9, when a certain denyTypes workaround is not used, mishandles attempts to create an instance of the primitive type 'void' during unmarshalling, leading to a remote application crash, as demonstrated by an xstream.fromXML("<void/>") call.
Vulnerability category: Input validation
Products affected by CVE-2017-7957
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
- cpe:2.3:a:xstream_project:xstream:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2017-7957
5.40%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 89 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2017-7957
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
5.0
|
MEDIUM | AV:N/AC:L/Au:N/C:N/I:N/A:P |
10.0
|
2.9
|
NIST | |
|
7.5
|
HIGH | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
3.9
|
3.6
|
NIST |
CWE ids for CVE-2017-7957
-
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.Assigned by: nvd@nist.gov (Primary)
References for CVE-2017-7957
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/125800
XStream denial of service CVE-2017-7957 Vulnerability ReportThird Party Advisory;VDB Entry
-
http://www.debian.org/security/2017/dsa-3841
Debian -- Security Information -- DSA-3841-1 libxstream-javaThird Party Advisory
-
https://access.redhat.com/errata/RHSA-2017:1832
RHSA-2017:1832 - Security Advisory - Red Hat Customer PortalThird Party Advisory
-
https://access.redhat.com/errata/RHSA-2017:2889
RHSA-2017:2889 - Security Advisory - Red Hat Customer PortalThird Party Advisory
-
https://access.redhat.com/errata/RHSA-2017:2888
RHSA-2017:2888 - Security Advisory - Red Hat Customer PortalThird Party Advisory
-
http://www.securitytracker.com/id/1039499
IBM Notes XStream Error Lets Remote Users Cause the Target Service to Crash - SecurityTrackerThird Party Advisory;VDB Entry
-
http://www.securityfocus.com/bid/100687
IBM QRadar SIEM CVE-2017-7957 Denial of Service VulnerabilityThird Party Advisory;VDB Entry
-
https://www-prd-trops.events.ibm.com/node/715749
Permissions Required
-
http://x-stream.github.io/CVE-2017-7957.html
XStream - CVE-2017-7957Vendor Advisory
Jump to