Integer Overflow Vulnerability in snappy-java Package Leading to Fatal Errors
Summary
UBUNTU-CVE-2023-34454: snappy-java is a fast compressor/decompressor for Java. Affects snappy-java versions 1.0.4.1~dfsg-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
snappy-java is a fast compressor/decompressor library for Java, designed to provide efficient data compression and decompression capabilities. It is widely used in various applications to enhance performance by reducing the size of data. However, certain versions of snappy-java are vulnerable to an integer overflow issue that can lead to severe application crashes and data loss.
Vulnerability Detail
The vulnerability arises from unchecked multiplications in the compress functions of snappy-java, specifically in the compress(char[] input) method. When the length of the input array is multiplied by two, it can result in an integer overflow, causing the length to become negative. This negative length is then passed to the native maxCompressedLength function, which treats it as an unsigned integer, potentially leading to a java.lang.NegativeArraySizeException when attempting to allocate an array. If the allocation succeeds with a positive size, it may still be insufficient for the compression process, resulting in fatal access violations. This vulnerability affects multiple data types, including char, double, float, int, long, and short, but is less likely to occur with byte arrays. The issue is patched in version 1.1.10.1.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using the compress functions that involve unchecked multiplications until the package is updated. Consider validating input lengths before passing them to the compression functions to prevent potential overflows.
Conclusion
The integer overflow vulnerability in the snappy-java package poses significant risks to applications relying on this library for data compression. It is crucial to update to the patched version 1.1.10.1 or later to mitigate these risks. Regular monitoring for vulnerabilities using tools like Vulert can help maintain the security and integrity of your software.
See every vulnerability recorded for snappy-java →
FAQ
The CVSS score of this vulnerability is 5.9, indicating a medium severity level.
Versions prior to 1.1.10.1 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The vulnerability can lead to application crashes, data loss, and potential access violations, impacting the stability and reliability of applications using the affected versions.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
Related vulnerabilities
Recent vulnerabilities recorded for snappy-java.
