Vulnerabilities
Projects
Vulnerability Disclosure
About Us
Contact Us
Mend.io Vulnerability Database
What is a WS vulnerability ID?
What is an MSC vulnerability ID?
We found results for “”
CVE-2023-43642
Good to know:
Date: September 25, 2023
snappy-java is a Java port of the snappy, a fast C++ compresser/decompresser developed by Google. The SnappyInputStream was found to be vulnerable to Denial of Service (DoS) attacks when decompressing data with a too large chunk size. Due to missing upper bound check on chunk length, an unrecoverable fatal error can occur. All versions of snappy-java including the latest released version 1.1.10.3 are vulnerable to this issue. A fix has been introduced in commit `9f8c3cf74` which will be included in the 1.1.10.4 release. Users are advised to upgrade. Users unable to upgrade should only accept compressed data from trusted sources.
Language: Java
Severity Score
Related Resources (6)
Severity Score
Weakness Type (CWE)
Allocation of Resources Without Limits or Throttling
CWE-770Top Fix
Upgrade Version
Upgrade to version igv - 2.8.10;igv - no_fix;igv - 2.8.3;pyspark - 3.5.0;pyspark - 3.2.3;pyspark - 3.3.2;tassel - no_fix;GridGain - 8.8.35;GridGain - 8.8.1;mzmine - no_fix;umicollapse - no_fix;MASES.KNet - 2.2.0;MASES.KafkaBridgeCLI - no_fix;gorpipe - no_fix;pepgenome - no_fix;igvtools - no_fix;MASES.KNetCLI - 2.2.0;MASES.KNetConnect - 2.2.0;MASES.KafkaBridge - no_fix;dsh-bio - no_fix;r-rtassel - no_fix;logstash-binary - no_fix;Cassandra - 2.2.5;mpa-portable - no_fix;org.xerial.snappy:snappy-java:1.1.10.4;io.syndesis.meta:meta:1.13.1;io.syndesis.meta:meta:1.13.1;org.kie:kie-server-spring-boot-sample:7.68.0.Final;org.apache.servicemix.bundles:org.apache.servicemix.bundles.snappy-java:no_fix;io.fabric8.quickstarts:spring-boot-camel-rhosak:no_fix;io.fabric8.quickstarts:spring-boot-camel-rhosak:no_fix;io.fabric8.quickstarts:spring-boot-camel-rhosak:no_fix;io.fabric8.quickstarts:spring-boot-camel-rhosak:no_fix;org.kie:keycloak-kie-server-spring-boot-sample:7.60.0.Final;org.kie:keycloak-kie-server-spring-boot-sample:7.68.0.Final;org.kie:kie-server-spring-boot-kafka-sample:7.68.0.Final;org.kie:kie-server-spring-boot-kafka-sample:7.60.0.Final;org.modeshape:modeshape-jca:3.4.0.Final;org.kie:kie-server-spring-boot-integ-tests-sample:7.68.0.Final
CVSS v3.1
| Base Score: |
|
|---|---|
| Attack Vector (AV): | NETWORK |
| Attack Complexity (AC): | LOW |
| Privileges Required (PR): | NONE |
| User Interaction (UI): | NONE |
| Scope (S): | UNCHANGED |
| Confidentiality (C): | NONE |
| Integrity (I): | NONE |
| Availability (A): | HIGH |