CVE-2023-34454: Integer Overflow vulnerability in snappy-java's compress leads to DoS
Summary
CVE-2023-34454: snappy-java's Integer Overflow vulnerability in compress leads to DoS. Affects org.xerial.snappy:snappy-java versions < 1.1.10.1. Fixed in 1.1.10.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The snappy-java package is a Java port of the Snappy compression algorithm. It provides a fast and efficient way to compress and decompress data in Java applications. The package is widely used in various Java projects for its performance and simplicity. However, a vulnerability has been discovered in the compress function of snappy-java, which can lead to a Denial of Service (DoS) attack.
Vulnerability Detail
The compress function in snappy-java's Snappy.java file is susceptible to an Integer Overflow vulnerability. When compressing an array of characters, the length of the input array is multiplied by 2 without proper validation. This multiplication can result in an integer overflow, causing an unrecoverable fatal error. The rawCompress function then uses the potentially negative length to allocate a byte array, leading to a java.lang.NegativeArraySizeException or a fatal Access Violation error. This vulnerability affects multiple data types, including char, double, float, int, long, and short.
How To Fix
Minimum fixed version
1.1.10.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the snappy-java package is not immediately feasible, a possible workaround is to avoid using the compress function with the affected data types (char, double, float, int, long, and short). Instead, consider using byte arrays for compression, as creating a byte array of a negative size is not possible. However, this workaround may not be applicable in all scenarios and should be thoroughly tested.
Conclusion
The Integer Overflow vulnerability in snappy-java's compress function can lead to a Denial of Service (DoS) attack. It is crucial to update the snappy-java package to version 1.1.10.1 or later to mitigate the risk. If immediate update is not possible, consider applying the provided workaround or disabling the usage of the compress function with the affected data types. For additional support and guidance, contact DevNack.com.
See every vulnerability recorded for org.xerial.snappy:snappy-java →
FAQ
The vulnerability can lead to a Denial of Service (DoS) attack, causing the affected Java application to crash or become unresponsive.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the pom.xml file of your application.
At the time of this report, there are no known public exploits targeting this vulnerability. However, it is important to promptly update the snappy-java package to mitigate the risk of a DoS attack.
While updating the snappy-java package is the recommended solution, if immediate update is not feasible, you can consider implementing the provided workaround or disabling the usage of the compress function with the affected data types.
For further support on vulnerability remediation and assistance in securing your Java application, you can reach out to info@devnack.com.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.xerial.snappy:snappy-java.
