Lucene search

JFROGCVE-2023-3782

HistoryJul 19, 2023 - 9:15 p.m.

CVE-2023-3782

2023-07-1921:15:10

CWE-400

JFROG

web.nvd.nist.gov

cve

dos

okhttp

brotliinterceptor

mitm

zip-bomb

http response

CVSS3

5.9

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

5.7

Confidence

High

EPSS

0.001

Percentile

27.6%

JSON

DoS of the OkHttp client when using a BrotliInterceptor and surfing to a malicious web server, or when an attacker can perform MitM to inject a Brotli zip-bomb into an HTTP response

Affected configurations

Nvd

Node

squareupokhttp-brotli

VendorProductVersionCPE
squareupokhttp-brotli*cpe:2.3:a:squareup:okhttp-brotli:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
squareup	okhttp-brotli	*	cpe:2.3:a:squareup:okhttp-brotli::::::::

CNA Affected

[
  {
    "collectionURL": "https://mvnrepository.com",
    "packageName": "com.squareup.okhttp3:okhttp-brotli",
    "versions": [
      {
        "lessThan": "*",
        "status": "affected",
        "version": "0",
        "versionType": "maven"
      }
    ]
  }
]

References

github.com/square/okhttp/issues/7738

research.jfrog.com/vulnerabilities/okhttp-client-brotli-dos/

CVSS3

5.9

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

5.7

Confidence

High

EPSS

0.001

Percentile

27.6%

JSON

Related for CVE-2023-3782