Denial of Service Vulnerability in snappy-java Package
Summary
DEBIAN-CVE-2023-43642: snappy-java is a Java port of the snappy, a fast C++ compresser/decompresser developed by Google. Affects snappy-java versions < 1.1.10.5-1. Fixed in 1.1.10.5-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
snappy-java is a Java port of the Snappy compression library developed by Google, designed for fast compression and decompression of data. It is widely used in applications that require efficient data handling. However, it has been identified that all versions, including the latest release 1.1.10.3, are vulnerable to a Denial of Service (DoS) attack due to improper handling of chunk sizes during decompression.
Vulnerability Detail
The vulnerability arises from the SnappyInputStream's failure to enforce an upper bound on the chunk length during decompression. This oversight can lead to an unrecoverable fatal error, potentially crashing the application and resulting in a Denial of Service. Attackers can exploit this flaw by sending specially crafted compressed data, causing the application to become unresponsive.
How To Fix
Minimum fixed version
1.1.10.5-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade snappy-javaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not feasible, users should only accept compressed data from trusted sources to mitigate the risk of exploitation. Implementing input validation to check the integrity and size of incoming compressed data can also help.
Conclusion
The snappy-java package is vulnerable to a Denial of Service attack due to improper handling of chunk sizes during decompression. Users are strongly advised to upgrade to the patched version to ensure the security and stability of their applications. For those unable to upgrade, accepting data only from trusted sources is crucial.
See every vulnerability recorded for snappy-java →
FAQ
The vulnerability is a Denial of Service (DoS) issue caused by a lack of upper bound checks on chunk sizes during decompression.
All versions of snappy-java, including the latest release 1.1.10.3, are vulnerable to this issue.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If upgrading is not possible, only accept compressed data from trusted sources and implement input validation to mitigate risks.
Yes, a patch has been introduced in version 1.1.10.5-1 of the snappy-java package.
References
Related vulnerabilities
Recent vulnerabilities recorded for snappy-java.
