fix(deps): update dependency com.thoughtworks.xstream:xstream to v1.4.21 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
com.thoughtworks.xstream:xstream (source)	1.4.20 → 1.4.21

---

XStream is vulnerable to a Denial of Service attack due to stack overflow from a manipulated binary input stream

CVE-2024-47072 / GHSA-hfq9-hggm-c56q

More information

Details

Impact

The vulnerability may allow a remote attacker to terminate the application with a stack overflow error resulting in a denial of service only by manipulating the processed input stream when XStream is configured to use the BinaryStreamDriver.

Patches

XStream 1.4.21 detects the manipulation in the binary input stream causing the the stack overflow and raises an InputManipulationException instead.

Workarounds

The only solution is to catch the StackOverflowError in the client code calling XStream if XStream is configured to use the BinaryStreamDriver.

References

See full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for CVE-2024-47072.

Credits

Alexis Challande of Trail Of Bits found and reported the issue to XStream and provided the required information to reproduce it.

Severity

• CVSS Score: 7.7 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P

References

• https://github.com/x-stream/xstream/security/advisories/GHSA-hfq9-hggm-c56q
• https://nvd.nist.gov/vuln/detail/CVE-2024-47072
• https://github.com/x-stream/xstream/commit/bb838ce2269cac47433e31c77b2b236466e9f266
• https://github.com/x-stream/xstream/commit/fdd9f7d3de0d7ccf2f9979bcd09fbf3e6a0c881a
• https://github.com/x-stream/xstream
• https://lists.debian.org/debian-lts-announce/2024/12/msg00023.html
• https://x-stream.github.io/CVE-2024-47072.html

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Test Results

675 tests   674 ✅  2m 14s ⏱️
114 suites    0 💤
114 files      1 ❌

For more details on these failures, see this check.

Results for commit c70cc8f.

♻️ This comment has been updated with latest results.

[jonbartels]

build failure