Published: 25/09/2023 Updated: 26/09/2023

CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9

VMScore: 0

snappy-java is a Java port of the snappy, a fast C++ compresser/decompresser developed by Google. The SnappyInputStream was found to be vulnerable to Denial of Service (DoS) attacks when decompressing data with a too large chunk size. Due to missing upper bound check on chunk length, an unrecoverable fatal error can occur. All versions of snappy-java including the latest released version 1.1.10.3 are vulnerable to this issue. A fix has been introduced in commit `9f8c3cf74` which will be included in the 1.1.10.4 release. Users are advised to upgrade. Users unable to upgrade should only accept compressed data from trusted sources.

Vulnerable Product	Search on Vulmon	Subscribe to Product
xerial snappy-java

Debian Bug report logs - #1053474 snappy-java: CVE-2023-43642 Package: src:snappy-java; Maintainer for src:snappy-java is Debian Java Maintainers <pkg-java-maintainers@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Wed, 4 Oct 2023 19:45:02 UTC Severity: important Tags: security ...

Synopsis Important: Red Hat build of Quarkus 2139 release and security update Type/Severity Security Advisory: Important Topic An update is now available for Red Hat build of QuarkusRed Hat Product Security has rated this update as having a security impact ofModerate A Common Vulnerability Scoring System (CVSS) base score, which gives ade ...

概要 Important: Red Hat build of Quarkus 329 release and security update タイプ/重大度 Security Advisory: Important トピック A new release of the Red Hat build of Quarkus is now available This new release comes packed with a host of enhancements, bug fixes, and security fixesRed Hat Product Security has rated this update as ha ...

DescriptionA flaw was found in SnappyInputStream in snappy-java, a data compression library in Java This issue occurs when decompressing data with a too-large chunk size due to a missing upper bound check on chunk length An unrecoverable fatal error can occur, resulting in a Denial of Service (DoS)A flaw was found in SnappyInputStream in ...

CWE-770 https://github.com/xerial/snappy-java/security/advisories/GHSA-55g7-9cwv-5qfv https://github.com/xerial/snappy-java/commit/9f8c3cf74223ed0a8a834134be9c917b9f10ceb5 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1053474 https://nvd.nist.gov https://access.redhat.com/security/cve/cve-2023-43642

CVE-2023-43642

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect