snappy-java up to 1.1.10.3 Compressed Data allocation of resources

Summaryinfo

A vulnerability has been found in snappy-java up to 1.1.10.3 and classified as problematic. Affected is an unknown function of the component Compressed Data Handler. Performing a manipulation results in allocation of resources. This vulnerability is reported as CVE-2023-43642. The attack is possible to be carried out remotely. No exploit exists. The affected component should be upgraded.

Detailsinfo

A vulnerability classified as problematic has been found in snappy-java up to 1.1.10.3 (Programming Language Software). This affects an unknown part of the component Compressed Data Handler. The manipulation with an unknown input leads to a allocation of resources vulnerability. CWE is classifying the issue as CWE-770. The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor. This is going to have an impact on availability. The summary by CVE is:

snappy-java is a Java port of the snappy, a fast C++ compresser/decompresser developed by Google. The SnappyInputStream was found to be vulnerable to Denial of Service (DoS) attacks when decompressing data with a too large chunk size. Due to missing upper bound check on chunk length, an unrecoverable fatal error can occur. All versions of snappy-java including the latest released version 1.1.10.3 are vulnerable to this issue. A fix has been introduced in commit `9f8c3cf74` which will be included in the 1.1.10.4 release. Users are advised to upgrade. Users unable to upgrade should only accept compressed data from trusted sources.

The weakness was disclosed 09/26/2023 as GHSA-55g7-9cwv-5qfv. It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2023-43642 since 09/20/2023. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1499 according to MITRE ATT&CK.

Upgrading to version 1.1.10.4 eliminates this vulnerability. Applying the patch 9f8c3cf74223ed0a8a834134be9c917b9f10ceb5 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Programming Language Software

Name

• snappy-java

Version

• 1.1.10.0
• 1.1.10.1
• 1.1.10.2
• 1.1.10.3

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion