CVE-2023-43642

Missing upper bound check on chunk length in snappy-java

Severity Score

7.5

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

Attend

*SSVC

Descriptions

snappy-java is a Java port of the snappy, a fast C++ compresser/decompresser developed by Google. The SnappyInputStream was found to be vulnerable to Denial of Service (DoS) attacks when decompressing data with a too large chunk size. Due to missing upper bound check on chunk length, an unrecoverable fatal error can occur. All versions of snappy-java including the latest released version 1.1.10.3 are vulnerable to this issue. A fix has been introduced in commit `9f8c3cf74` which will be included in the 1.1.10.4 release. Users are advised to upgrade. Users unable to upgrade should only accept compressed data from trusted sources.

snappy-java es una adaptación Java de snappy, un rápido compresor/descompresor de C++ desarrollado por Google. Se descubrió que SnappyInputStream era vulnerable a ataques de denegación de servicio (DoS) al descomprimir datos con un tamaño de fragmento demasiado grande. Debido a que falta la verificación del límite superior en la longitud del fragmento, puede ocurrir un error fatal irrecuperable. Todas las versiones de snappy-java, incluida la última versión 1.1.10.3, son vulnerables a este problema.
Se introdujo una solución en el commit `9f8c3cf74` que se incluirá en la versión 1.1.10.4.
Se recomienda a los usuarios que actualicen. Los usuarios que no puedan actualizar solo deben aceptar datos comprimidos de fuentes confiables.

A flaw was found in SnappyInputStream in snappy-java, a data compression library in Java. This issue occurs when decompressing data with a too-large chunk size due to a missing upper bound check on chunk length. An unrecoverable fatal error can occur, resulting in a Denial of Service (DoS).

*Credits: N/A

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

None

Integrity

None

Availability

Complete

* Common Vulnerability Scoring System

SSVC

Decision:Attend

Exploitation

Poc

Automatable

Yes

Tech. Impact

Partial

* Organization's Worst-case Scenario

Timeline

2023-09-20 CVE Reserved
2023-09-25 CVE Published
2024-09-24 CVE Updated
2024-09-24 First Exploit
2025-04-18 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-770: Allocation of Resources Without Limits or Throttling

CAPEC

References (4)

URL	Tag	Source

URL	Date	SRC
https://github.com/xerial/snappy-java/security/advisories/GHSA-55g7-9cwv-5qfv	2024-09-24

URL	Date	SRC
https://github.com/xerial/snappy-java/commit/9f8c3cf74223ed0a8a834134be9c917b9f10ceb5	2023-09-26

URL	Date	SRC
https://access.redhat.com/security/cve/CVE-2023-43642	2024-05-30
https://bugzilla.redhat.com/show_bug.cgi?id=2241722	2024-05-30

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Xerial Search vendor "Xerial"		Snappy-java Search vendor "Xerial" for product "Snappy-java"				< 1.1.10.4 Search vendor "Xerial" for product "Snappy-java" and version " < 1.1.10.4"		-		Affected