CVE-2023-43642
Description
snappy-java is a Java port of the snappy, a fast C++ compresser/decompresser developed by Google. The SnappyInputStream was found to be vulnerable to Denial of Service (DoS) attacks when decompressing data with a too large chunk size. Due to missing upper bound check on chunk length, an unrecoverable fatal error can occur. All versions of snappy-java including the latest released version 1.1.10.3 are vulnerable to this issue. A fix has been introduced in commit 9f8c3cf74 which will be included in the 1.1.10.4 release. Users are advised to upgrade. Users unable to upgrade should only accept compressed data from trusted sources.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.xerial.snappy:snappy-javaMaven | < 1.1.10.4 | 1.1.10.4 |
Affected products
8- ghsa-coords6 versionspkg:maven/org.xerial.snappy/snappy-javapkg:apk/chainguard/stargatepkg:apk/chainguard/druidpkg:apk/chainguard/kafkapkg:apk/wolfi/druidpkg:apk/wolfi/kafka
< 1.1.10.4+ 5 more
- (no CPE)range: < 1.1.10.4
- (no CPE)range: < 1.0.80-r0
- (no CPE)range: < 37.0.0-r0
- (no CPE)range: < 3.5.1-r3
- (no CPE)range: < 37.0.0-r0
- (no CPE)range: < 3.5.1-r3
cpe:2.3:a:xerial:snappy-java:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:xerial:snappy-java:*:*:*:*:*:*:*:*range: <1.1.10.4
- (no CPE)range: < 1.1.10.4
Patches
Vulnerability mechanics
References
5- github.com/xerial/snappy-java/commit/9f8c3cf74223ed0a8a834134be9c917b9f10ceb5nvdPatchWEB
- github.com/xerial/snappy-java/security/advisories/GHSA-55g7-9cwv-5qfvnvdExploitWEB
- github.com/advisories/GHSA-55g7-9cwv-5qfvghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2023-43642ghsaADVISORY
- github.com/xerial/snappy-java/releases/tag/v1.1.10.4ghsaWEB
News mentions
0No linked articles in our index yet.