CVE-2023-3635

2023-07-1219:15:08

CWE-681

CWE-195

[email protected]

web.nvd.nist.gov

213

cve-2023-3635

exception handling

denial of service

okio client

gzipsource

vulnerability

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7.1 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

19.9%

JSON

GzipSource does not handle an exception that might be raised when parsing a malformed gzip buffer. This may lead to denial of service of the Okio client when handling a crafted GZIP archive, by using the GzipSource class.

Affected configurations

NVD

Node

squareupokioRange0.5.0–1.17.6

squareupokioRange2.0.0–3.4.0

CPENameOperatorVersion
squareup:okiosquareup okiolt1.17.6
squareup:okiosquareup okiolt3.4.0

CPE	Name	Operator	Version
squareup:okio	squareup okio	lt	1.17.6
squareup:okio	squareup okio	lt	3.4.0

CNA Affected

[
  {
    "collectionURL": "https://mvnrepository.com",
    "defaultStatus": "unaffected",
    "packageName": "com.squareup.okio:okio",
    "versions": [
      {
        "lessThan": "1.0.0",
        "status": "affected",
        "version": "0.5.0",
        "versionType": "maven"
      },
      {
        "lessThan": "1.17.6",
        "status": "affected",
        "version": "1.0.0",
        "versionType": "maven"
      },
      {
        "lessThan": "3.0.0",
        "status": "affected",
        "version": "2.0.0",
        "versionType": "maven"
      },
      {
        "lessThan": "3.4.0",
        "status": "affected",
        "version": "3.0.0",
        "versionType": "maven"
      }
    ]
  }
]