Out-of-Bounds Write Vulnerability in Bzip2 Libraries
Summary
CVE-2019-12900: out-of-bounds write when there are many bzip2 selectors. Affects bzlib versions >= 0.4, < 0.5.2.0. Fixed in 0.5.2.0. How to fix ↓
Also tracked for
- bzip2 · Alpine:v3.10
The same CVE-2019-12900 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Bzip2 libraries are commonly used for compressing and decompressing data in various network services and command line utilities. These libraries provide functionality for handling bzip2 payloads, which are vulnerable to a specific out-of-bounds write vulnerability. The vulnerability arises when there are many bzip2 selectors, leading to a memory corruption issue. It is important to note that this vulnerability affects Haskell libraries that are built using the bundled C library source code, which is the default in most cases.
Vulnerability Detail
The out-of-bounds write vulnerability in the Bzip2 libraries can be exploited by a malicious bzip2 payload, potentially resulting in a denial of service or remote code execution. Network services or command line utilities that decompress untrusted bzip2 payloads are at risk. The exploitation of this vulnerability relies on an undefined behavior that appears to be handled safely by current compilers.
How To Fix
Minimum fixed version
0.5.2.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The out-of-bounds write vulnerability in the Bzip2 libraries can lead to memory corruption, denial of service, or remote code execution. It is crucial to update the affected packages to the fixed versions mentioned above. For further support and assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for bzlib →
FAQ
The 'bzlib', 'bz2', and 'bzlib-conduit' packages in the Haskell ecosystem are affected by this vulnerability.
The severity of this vulnerability is rated as CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your manifest file, such as package-lock.json, and the playground will provide real-time monitoring and alerts for open-source vulnerabilities.
There are no known exploits for this vulnerability at the time of this advisory.
You can find more information about this vulnerability, including the source code and specific version ranges, in the Haskell Security Advisories database at the following URL: [source]
