Lucene search

K
atlassianSecurity-metrics-botBSERV-19095
HistoryJan 08, 2024 - 8:45 p.m.

DoS (Denial of Service) org.xerial.snappy:snappy-java Dependency in Bitbucket Data Center and Server

2024-01-0820:45:44
security-metrics-bot
jira.atlassian.com
9
dos vulnerability
org.xerial.snappy:snappy-java
bitbucket data center
server
unauthenticated attacker
availability impact
upgrade
release notes
integer overflow
unchecked multiplications

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

6.9 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

25.2%

This High severity org.xerial.snappy:snappy-java Dependency vulnerability was introduced in versions 7.21.0, 8.9.0 and 8.13.0 of Bitbucket Data Center and Server.

This org.xerial.snappy:snappy-java Dependency vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H allows an unauthenticated attacker to expose assets in your environment susceptible to exploitation which has no impact to confidentiality, no impact to integrity, high impact to availability, and requires no user interaction.

Atlassian recommends that Bitbucket Data Center and Server customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions:

  • Bitbucket Data Center and Server 7.21: Upgrade to a release greater than or equal to 7.21.21

  • Bitbucket Data Center and Server 8.9: Upgrade to a release greater than or equal to 8.9.5

  • Bitbucket Data Center and Server 8.13: Upgrade to a release greater than or equal to 8.13.1

See the release notes ([https://confluence.atlassian.com/bitbucketserver/release-notes]). You can download the latest version of Bitbucket Data Center and Server from the download center ([https://www.atlassian.com/software/bitbucket/download-archives]).

The National Vulnerability Database provides the following description for this vulnerability: snappy-java is a fast compressor/decompressor for Java. Due to unchecked multiplications, an integer overflow may occur in versions prior to 1.1.10.1, causing an unrecoverable fatal error.

The function compress(char[] input) in the file Snappy.java receives an array of characters and compresses it. It does so by multiplying the length by 2 and passing it to the rawCompress` function.

Since the length is not tested, the multiplication by two can cause an integer overflow and become negative. The rawCompress function then uses the received length and passes it to the natively compiled maxCompressedLength function, using the returned value to allocate a byte array.

Since the maxCompressedLength function treats the length as an unsigned integer, it doesnโ€™t care that it is negative, and it returns a valid value, which is casted to a signed integer by the Java engine. If the result is negative, a java.lang.NegativeArraySizeException exception will be raised while trying to allocate the array buf. On the other side, if the result is positive, the buf array will successfully be allocated, but its size might be too small to use for the compression, causing a fatal Access Violation error.

The same issue exists also when using the compress functions that receive double, float, int, long and short, each using a different multiplier that may cause the same issue. The issue most likely wonโ€™t occur when using a byte array, since creating a byte array of size 0x80000000 (or any other negative value) is impossible in the first place.

Version 1.1.10.1 contains a patch for this issue.

Affected configurations

Vulners
Node
atlassianbitbucket_data_centerRangeโ‰ค7.21.0
OR
atlassianbitbucket_data_centerRangeโ‰ค7.21.1
OR
atlassianbitbucket_data_centerRangeโ‰ค7.21.2
OR
atlassianbitbucket_data_centerRangeโ‰ค7.21.3
OR
atlassianbitbucket_data_centerRangeโ‰ค7.21.4
OR
atlassianbitbucket_data_centerRangeโ‰ค7.21.5
OR
atlassianbitbucket_data_centerRangeโ‰ค7.21.6
OR
atlassianbitbucket_data_centerRangeโ‰ค7.21.7
OR
atlassianbitbucket_data_centerRangeโ‰ค7.21.8
OR
atlassianbitbucket_data_centerRangeโ‰ค7.21.9
OR
atlassianbitbucket_data_centerRangeโ‰ค7.21.10
OR
atlassianbitbucket_data_centerRangeโ‰ค7.21.11
OR
atlassianbitbucket_data_centerRangeโ‰ค7.21.12
OR
atlassianbitbucket_data_centerRangeโ‰ค7.21.13
OR
atlassianbitbucket_data_centerRangeโ‰ค8.7.0
OR
atlassianbitbucket_data_centerRangeโ‰ค8.8.0
OR
atlassianbitbucket_data_centerRangeโ‰ค8.9.0
OR
atlassianbitbucket_data_centerRangeโ‰ค8.9.1
OR
atlassianbitbucket_data_centerRangeโ‰ค8.9.2
OR
atlassianbitbucket_data_centerRangeโ‰ค8.10.0
OR
atlassianbitbucket_data_centerRangeโ‰ค8.10.1
OR
atlassianbitbucket_data_centerRangeโ‰ค8.10.2
OR
atlassianbitbucket_data_centerRangeโ‰ค8.11.0
OR
atlassianbitbucket_data_centerRangeโ‰ค8.11.1
OR
atlassianbitbucket_data_centerRangeโ‰ค8.12.0
OR
atlassianbitbucket_data_centerRangeโ‰ค8.9.3
OR
atlassianbitbucket_data_centerRangeโ‰ค8.10.3
OR
atlassianbitbucket_data_centerRangeโ‰ค8.11.2
OR
atlassianbitbucket_data_centerRangeโ‰ค7.21.14
OR
atlassianbitbucket_data_centerRangeโ‰ค7.21.15
OR
atlassianbitbucket_data_centerRangeโ‰ค8.9.4
OR
atlassianbitbucket_data_centerRangeโ‰ค8.10.4
OR
atlassianbitbucket_data_centerRangeโ‰ค8.11.3
OR
atlassianbitbucket_data_centerRangeโ‰ค8.12.1
OR
atlassianbitbucket_data_centerRangeโ‰ค8.13.0
OR
atlassianbitbucket_data_centerRangeโ‰ค7.21.16
OR
atlassianbitbucket_data_centerRangeโ‰ค7.21.17
OR
atlassianbitbucket_data_centerRangeโ‰ค7.21.18
OR
atlassianbitbucket_data_centerRange<8.14.0
OR
atlassianbitbucket_data_centerRange<8.13.1
OR
atlassianbitbucket_data_centerRange<8.9.5
OR
atlassianbitbucket_data_centerRange<7.21.21

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

6.9 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

25.2%