Security Exception in java.util.Arrays.copyOf in apache-poi
Summary
OSV-2023-961: Security exception in java.base/java.util.Arrays.copyOf. Affects apache-poi versions >= 1b88529d072a9d4462c445a9953b898cb37c6913, < 638a9be903dd75f58ab3a260102f4687619784c7. Fixed in 638a9be903dd75f58ab3a260102f4687619784c7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The apache-poi package is a popular Java library used for reading and writing Microsoft Office file formats, such as Excel, Word, and PowerPoint. It provides functionality to manipulate these files programmatically. However, a security vulnerability has been identified in the package's usage of the java.util.Arrays.copyOf method.
Vulnerability Detail
The vulnerability occurs in the java.util.Arrays.copyOf method, which is used by the apache-poi package. It can lead to a security exception, potentially allowing an attacker to execute arbitrary code or cause a denial of service. The vulnerability has a low severity rating and has been reported through the OSS-Fuzz project. The crash state indicates that the issue lies in the AbstractStringBuilder class, specifically in the ensureCapacityInternal and append methods.
How To Fix
Minimum fixed version
638a9be903dd75f58ab3a260102f4687619784c7
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is advised to update the package to the fixed version as soon as possible.
Conclusion
In conclusion, the apache-poi package is vulnerable to a security exception in the java.util.Arrays.copyOf method. It is recommended to update the package to a version that includes the fix to mitigate the risk. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for apache-poi →
FAQ
This vulnerability can potentially allow an attacker to execute arbitrary code or cause a denial of service.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your manifest file, such as package-lock.json, and Vulert will analyze it in real-time.
The vulnerability has a low severity rating.
There is no known exploit for this vulnerability at the moment.
You can find more information about this vulnerability in the OSS-Fuzz report at https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62959.
References
Related vulnerabilities
Recent vulnerabilities recorded for apache-poi.
