snappy-java is a fast compressor/decompressor for Java. Due to unchecked multiplications, an integer overflow may occur in versions prior to 1.1.10.1, causing a fatal error.
The function `shuffle(int[] input)` in the file `BitShuffle.java` receives an array of integers and applies a bit shuffle on it. It does so by multiplying the length by 4 and passing it to the natively compiled shuffle function. Since the length is not tested, the multiplication by four can cause an integer overflow and become a smaller value than the true size, or even zero or negative. In the case of a negative value, a `java.lang.NegativeArraySizeException` exception will raise, which can crash the program. In a case of a value that is zero or too small, the code that afterwards references the shuffled array will assume a bigger size of the array, which might cause exceptions such as `java.lang.ArrayIndexOutOfBoundsException`.
The same issue exists also when using the `shuffle` functions that receive a double, float, long and short, each using a different multiplier that may cause the same issue.
Version 1.1.10.1 contains a patch for this vulnerability.
CVE-2023-34453 - Medium Severity Vulnerability
snappy-java-1.0.4.1.jar
snappy-java: A fast compression/decompression library
Library home page: http://code.google.com/p/snappy-java/
Path to dependency file: /tensorflow/java/maven/tensorflow-hadoop/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/xerial/snappy/snappy-java/1.0.4.1/snappy-java-1.0.4.1.jar
Dependency Hierarchy: - hadoop-common-2.6.0.jar (Root Library) - avro-1.7.4.jar - :x: **snappy-java-1.0.4.1.jar** (Vulnerable Library)
snappy-java-1.1.2.6.jar
snappy-java: A fast compression/decompression library
Library home page: https://github.com/xerial/snappy-java
Path to dependency file: /tensorflow/java/maven/spark-tensorflow-connector/pom.xml
Path to vulnerable library: /tmp/ws-ua_20211122053754_TJIUSD/downloadResource_VHVETE/20211122053839/snappy-java-1.1.2.6.jar
Dependency Hierarchy: - tensorflow-hadoop-1.15.0.jar (Root Library) - hadoop-common-2.6.0.jar - avro-1.8.2.jar - :x: **snappy-java-1.1.2.6.jar** (Vulnerable Library)
Found in HEAD commit: 1f65fd168afc52c040a47230bb3cb902f7223124
Found in base branch: master
snappy-java is a fast compressor/decompressor for Java. Due to unchecked multiplications, an integer overflow may occur in versions prior to 1.1.10.1, causing a fatal error. The function `shuffle(int[] input)` in the file `BitShuffle.java` receives an array of integers and applies a bit shuffle on it. It does so by multiplying the length by 4 and passing it to the natively compiled shuffle function. Since the length is not tested, the multiplication by four can cause an integer overflow and become a smaller value than the true size, or even zero or negative. In the case of a negative value, a `java.lang.NegativeArraySizeException` exception will raise, which can crash the program. In a case of a value that is zero or too small, the code that afterwards references the shuffled array will assume a bigger size of the array, which might cause exceptions such as `java.lang.ArrayIndexOutOfBoundsException`. The same issue exists also when using the `shuffle` functions that receive a double, float, long and short, each using a different multiplier that may cause the same issue. Version 1.1.10.1 contains a patch for this vulnerability.
Publish Date: 2023-06-15
URL: CVE-2023-34453
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here.Type: Upgrade version
Origin: https://github.com/xerial/snappy-java/security/advisories/GHSA-pqr6-cmr2-h8hf
Release Date: 2023-06-15
Fix Resolution (org.xerial.snappy:snappy-java): 1.1.10.1
Direct dependency fix Resolution (org.apache.hadoop:hadoop-common): 2.6.1
Step up your Open Source Security Game with Mend here