Critical Vulnerability in Snappy-Java Package: Unchecked Chunk Length Leading to Fatal Errors
Summary
UBUNTU-CVE-2023-34455: snappy-java is a fast compressor/decompressor for Java. Affects snappy-java versions 1.0.4.1~dfsg-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Snappy-Java is a high-performance compression and decompression library for Java applications. It is designed to provide fast and efficient data processing, making it a popular choice for developers working with large datasets. However, versions prior to 1.1.10.1 are susceptible to a critical vulnerability that can lead to severe runtime errors, impacting application stability and performance.
Vulnerability Detail
The vulnerability arises from the use of an unchecked chunk length in the Snappy-Java library. Specifically, the function 'hasNextChunk' in the file SnappyInputStream.java attempts to read 4 bytes to determine the length of the next chunk. If the read operation fails, it returns false. However, if the read is successful, the code assumes the read bytes represent a valid chunk length. This assumption can lead to a negative chunk size being processed, resulting in a java.lang.NegativeArraySizeException. In extreme cases, a large positive value can cause a java.lang.OutOfMemoryError, leading to application crashes. The vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate patching is not feasible, consider implementing input validation to ensure that chunk sizes are checked before processing. This can help mitigate the risk of negative or excessively large chunk sizes causing runtime errors.
Conclusion
The Snappy-Java library has a critical vulnerability that can lead to severe runtime errors if not addressed. Updating to version 1.1.10.1 or later is crucial to maintain application stability. For ongoing monitoring, consider using Vulert to stay informed about potential vulnerabilities in your software.
See every vulnerability recorded for snappy-java →
FAQ
Snappy-Java is used for fast compression and decompression of data in Java applications, optimizing performance for data-intensive tasks.
Exploiting this vulnerability can lead to application crashes, resulting in downtime and potential data loss.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities using just a manifest file like package-lock.json.
Implement input validation as a temporary workaround to prevent negative or excessively large chunk sizes from causing errors.
Related vulnerabilities
Recent vulnerabilities recorded for snappy-java.
