PT-2023-4869 · Atlassian · Bitbucket Server +2

🗓️ 15 Jun 2023 00:00:00Reported by Positive TechnologiesType

ptsecurity🔗 dbugs.ptsecurity.com👁 1 Views

Integer overflow in snappy-java compress may crash; upgrade to 1.1.10.1+ and update Bitbucket.

Reporter	Title	Published	Views	Family All 69
IBM Security Bulletins	Security Bulletin: IBM Event Streams is vulnerable to denial of service attacks due to snappy-java (CVE-2023-34453, CVE-2023-34455, CVE-2023-34454)	29 Aug 202309:37	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for October 2023	26 Mar 202504:03	–	ibm
IBM Security Bulletins	Security Bulletin: Snappy-java is vulnerable to security CVEs used in IBM Maximo Application Suite - Monitor Component	24 Jul 202321:00	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Application Performance Management	14 Feb 202408:43	–	ibm
IBM Security Bulletins	Security Bulletin: User Behavior Analytics application add on to IBM QRadar SIEM is vulnerable to using components with known vulnerabilities	10 May 202415:38	–	ibm
IBM Security Bulletins	Security Bulletin: Kafka nodes in IBM App Connect Enterprise and IBM Integration Bus are vulnerable to a denial of service due to snappy-java (CVE-2023-34453, CVE-2023-34455, CVE-2023-34454).	14 Aug 202308:42	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Asset Data Dictionary Component uses zookeeper-3.5.9.jar and snappy-java-1.1.8.3.jar which are vulnerable to CVE-2023-44981,CVE-2023-34453, CVE-2023-34455 , CVE-2023-34454 and CVE-2023-43642	7 Jun 202406:44	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Operations Analytics Predictive Insights.	27 Mar 202415:37	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple denial of Service vulnerabilities in snappy-java may affect IBM Business Automation Workflow (CVE-2023-34453, CVE-2023-34454, CVE-2023-34455)	1 Sep 202319:58	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling B2B Integrator affected by multiple vulnerabilities due to snappy-java	22 Feb 202416:22	–	ibm

Source	Link
github	www.github.com/xerial/snappy-java/security/advisories/GHSA-fjpj-2g6w-x25r
github	www.github.com/xerial/snappy-java/commit/d0042551e4a3509a725038eb9b2ad1f683674d94
ubuntu	www.ubuntu.com/security/CVE-2023-34454
cve	www.cve.org/CVERecord
osv	www.osv.dev/vulnerability/UBUNTU-CVE-2023-34454
osv	www.osv.dev/vulnerability/CVE-2023-34454
osv	www.osv.dev/vulnerability/GHSA-fjpj-2g6w-x25r
nvd	www.nvd.nist.gov/vuln/detail/CVE-2023-34454
bdu	www.bdu.fstec.ru/vul/2023-05356
cve	www.cve.mitre.org/cgi-bin/cvename.cgi

12 Dec 2024 00:00Current

7.1High risk

Vulners AI Score7.1

CVSS 27.8

CVSS 3.15.9 - 7.5

EPSS0.00667

SSVC