snappy-java's missing upper bound check on chunk length can lead to Denial of Service (DoS) impact

🗓️ 25 Sep 2023 18:30:18Reported by GitHub Advisory DatabaseType

snappy-java vulnerability fixed in 1.1.10.4, missing upper bound check on chunk length can lead to DoS impac

Reporter	Title	Published	Views	Family All 93
IBM Security Bulletins	Security Bulletin: IBM Datapower Operations Dashboard is vulnerable to a denial of service CVE-2023-43642	13 Mar 202414:29	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise and IBM Integration Bus are vulnerable to a denial of service due to snappy-java CVE-2023-43642)	28 Nov 202317:42	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities have been identified in IBM Db2 shipped with IBM WebSphere Remote Server	14 Dec 202321:06	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Event Streams is vulnerable to a denial of service attack due to the snappy-java (CVE-2023-43642).	23 Jul 202407:39	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Operator for Apache Flink is affected by a vulnerability in snappy-java (CVE-2023-43642)	29 Nov 202322:30	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability with snappy-java affect IBM Cloud Object Storage Systems (Oc2023v1)	16 Oct 202315:04	–	ibm
IBM Security Bulletins	Security Bulletin:Vulnerability in snappy-java affects watsonx.data	7 Feb 202510:53	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in snappy-java [CVE-2023-43642]	31 Jan 202423:27	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Asset Data Dictionary Component uses zookeeper-3.5.9.jar and snappy-java-1.1.8.3.jar which are vulnerable to CVE-2023-44981,CVE-2023-34453, CVE-2023-34455 , CVE-2023-34454 and CVE-2023-43642	7 Jun 202406:44	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to multiple Base OS issues	5 Feb 202418:46	–	ibm

Vulners

Node

org.xerial.snappy snappy-javaRange≤1.1.10.3maven

Source	Link
github	www.github.com/xerial/snappy-java/security/advisories/GHSA-55g7-9cwv-5qfv
github	www.github.com/xerial/snappy-java/commit/9f8c3cf74223ed0a8a834134be9c917b9f10ceb5
github	www.github.com/xerial/snappy-java/releases/tag/v1.1.10.4
nvd	www.nvd.nist.gov/vuln/detail/CVE-2023-43642
github	www.github.com/advisories/GHSA-55g7-9cwv-5qfv

07 Nov 2023 05:05Current

6.8Medium risk

Vulners AI Score6.8

CVSS 3.17.5

EPSS0.00247

SSVC

CWE-770