fix(deps): update dependency com.thoughtworks.xstream:xstream to v1.4.21 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
com.thoughtworks.xstream:xstream (source)	1.4.20 → 1.4.21

---

XStream is vulnerable to a Denial of Service attack due to stack overflow from a manipulated binary input stream

CVE-2024-47072 / GHSA-hfq9-hggm-c56q

More information

Details

Impact

The vulnerability may allow a remote attacker to terminate the application with a stack overflow error resulting in a denial of service only by manipulating the processed input stream when XStream is configured to use the BinaryStreamDriver.

Patches

XStream 1.4.21 detects the manipulation in the binary input stream causing the the stack overflow and raises an InputManipulationException instead.

Workarounds

The only solution is to catch the StackOverflowError in the client code calling XStream if XStream is configured to use the BinaryStreamDriver.

References

See full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for CVE-2024-47072.

Credits

Alexis Challande of Trail Of Bits found and reported the issue to XStream and provided the required information to reproduce it.

Severity

• CVSS Score: 7.7 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P

References

• https://github.com/x-stream/xstream/security/advisories/GHSA-hfq9-hggm-c56q
• https://nvd.nist.gov/vuln/detail/CVE-2024-47072
• https://github.com/x-stream/xstream/commit/bb838ce2269cac47433e31c77b2b236466e9f266
• https://github.com/x-stream/xstream/commit/fdd9f7d3de0d7ccf2f9979bcd09fbf3e6a0c881a
• https://github.com/x-stream/xstream
• https://lists.debian.org/debian-lts-announce/2024/12/msg00023.html
• https://x-stream.github.io/CVE-2024-47072.html

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Test Results

0 tests   0 ✅  0s ⏱️
0 suites  0 💤
0 files    0 ❌

Results for commit 2ca1832.

♻️ This comment has been updated with latest results.

[jonbartels]

build failure

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: gradle/libs.versions.toml

Command failed: ./gradlew -Dorg.gradle.jvmargs=-Xms512m -Xmx512m --console=plain --dependency-verification lenient -q --write-verification-metadata sha256 dependencies

FAILURE: Build completed with 2 failures.

1: Task failed with an exception.
-----------
* What went wrong:
A problem occurred configuring root project 'open-integration-engine'.
> Could not resolve all artifacts for configuration 'classpath'.
   > Could not resolve org.owasp:dependency-check-core:12.2.2.
     Required by:
         root project : > org.owasp.dependencycheck:org.owasp.dependencycheck.gradle.plugin:12.2.2 > org.owasp:dependency-check-gradle:12.2.2
      > Could not resolve org.owasp:dependency-check-core:12.2.2.
         > Could not get resource 'https://plugins.gradle.org/m2/org/owasp/dependency-check-core/12.2.2/dependency-check-core-12.2.2.pom'.
            > Could not GET 'https://repo.maven.apache.org/maven2/org/owasp/dependency-check-core/12.2.2/dependency-check-core-12.2.2.pom'. Received status code 429 from server: Too Many Requests
   > Could not resolve org.owasp:dependency-check-utils:12.2.2.
     Required by:
         root project : > org.owasp.dependencycheck:org.owasp.dependencycheck.gradle.plugin:12.2.2 > org.owasp:dependency-check-gradle:12.2.2
      > Could not resolve org.owasp:dependency-check-utils:12.2.2.
         > Could not get resource 'https://plugins.gradle.org/m2/org/owasp/dependency-check-utils/12.2.2/dependency-check-utils-12.2.2.pom'.
            > Could not GET 'https://repo.maven.apache.org/maven2/org/owasp/dependency-check-utils/12.2.2/dependency-check-utils-12.2.2.pom'. Received status code 429 from server: Too Many Requests
   > Could not resolve net.gpedro.integrations.slack:slack-webhook:1.4.0.
     Required by:
         root project : > org.owasp.dependencycheck:org.owasp.dependencycheck.gradle.plugin:12.2.2 > org.owasp:dependency-check-gradle:12.2.2
      > Could not resolve net.gpedro.integrations.slack:slack-webhook:1.4.0.
         > Could not get resource 'https://plugins.gradle.org/m2/net/gpedro/integrations/slack/slack-webhook/1.4.0/slack-webhook-1.4.0.pom'.
            > Could not GET 'https://repo.maven.apache.org/maven2/net/gpedro/integrations/slack/slack-webhook/1.4.0/slack-webhook-1.4.0.pom'. Received status code 429 from server: Too Many Requests

* Try:
> Run with --stacktrace option to get the stack trace.
> Run with --info or --debug option to get more log output.
> Run with --scan to get full insights.
> Get more help at https://help.gradle.org.
==============================================================================

2: Task failed with an exception.
-----------
* What went wrong:
A problem occurred configuring root project 'open-integration-engine'.
> Could not resolve all artifacts for configuration 'classpath'.
   > Could not resolve org.owasp:dependency-check-core:12.2.2.
     Required by:
         root project : > org.owasp.dependencycheck:org.owasp.dependencycheck.gradle.plugin:12.2.2 > org.owasp:dependency-check-gradle:12.2.2
      > Could not resolve org.owasp:dependency-check-core:12.2.2.
         > Could not get resource 'https://plugins.gradle.org/m2/org/owasp/dependency-check-core/12.2.2/dependency-check-core-12.2.2.pom'.
            > Could not GET 'https://repo.maven.apache.org/maven2/org/owasp/dependency-check-core/12.2.2/dependency-check-core-12.2.2.pom'. Received status code 429 from server: Too Many Requests
   > Could not resolve org.owasp:dependency-check-utils:12.2.2.
     Required by:
         root project : > org.owasp.dependencycheck:org.owasp.dependencycheck.gradle.plugin:12.2.2 > org.owasp:dependency-check-gradle:12.2.2
      > Could not resolve org.owasp:dependency-check-utils:12.2.2.
         > Could not get resource 'https://plugins.gradle.org/m2/org/owasp/dependency-check-utils/12.2.2/dependency-check-utils-12.2.2.pom'.
            > Could not GET 'https://repo.maven.apache.org/maven2/org/owasp/dependency-check-utils/12.2.2/dependency-check-utils-12.2.2.pom'. Received status code 429 from server: Too Many Requests
   > Could not resolve net.gpedro.integrations.slack:slack-webhook:1.4.0.
     Required by:
         root project : > org.owasp.dependencycheck:org.owasp.dependencycheck.gradle.plugin:12.2.2 > org.owasp:dependency-check-gradle:12.2.2
      > Could not resolve net.gpedro.integrations.slack:slack-webhook:1.4.0.
         > Could not get resource 'https://plugins.gradle.org/m2/net/gpedro/integrations/slack/slack-webhook/1.4.0/slack-webhook-1.4.0.pom'.
            > Could not GET 'https://repo.maven.apache.org/maven2/net/gpedro/integrations/slack/slack-webhook/1.4.0/slack-webhook-1.4.0.pom'. Received status code 429 from server: Too Many Requests

* Try:
> Run with --stacktrace option to get the stack trace.
> Run with --info or --debug option to get more log output.
> Run with --scan to get full insights.
> Get more help at https://help.gradle.org.
==============================================================================

BUILD FAILED in 52s