snappy-java is a fast compressor/decompressor for Java. Due to unchecked multiplications, an integer overflow may occur in versions prior to 1.1.10.1, causing a fatal error.
The function `shuffle(int[] input)` in the file `BitShuffle.java` receives an array of integers and applies a bit shuffle on it. It does so by multiplying the length by 4 and passing it to the natively compiled shuffle function. Since the length is not tested, the multiplication by four can cause an integer overflow and become a smaller value than the true size, or even zero or negative. In the case of a negative value, a `java.lang.NegativeArraySizeException` exception will raise, which can crash the program. In a case of a value that is zero or too small, the code that afterwards references the shuffled array will assume a bigger size of the array, which might cause exceptions such as `java.lang.ArrayIndexOutOfBoundsException`.
The same issue exists also when using the `shuffle` functions that receive a double, float, long and short, each using a different multiplier that may cause the same issue.
Version 1.1.10.1 contains a patch for this vulnerability.
CVE-2023-34453 - High Severity Vulnerability
snappy-java-1.0.5.jar
snappy-java: A fast compression/decompression library
Library home page: http://github.com/xerial/snappy-java/
Path to vulnerable library: /root/.ivy2/cache/org.xerial.snappy/snappy-java/bundles/snappy-java-1.0.5.jar
Dependency Hierarchy: - bijection-avro_2.11-0.9.6.jar (Root Library) - avro-1.7.5.jar - :x: **snappy-java-1.0.5.jar** (Vulnerable Library)
snappy-java-1.0.4.1.jar
snappy-java: A fast compression/decompression library
Library home page: http://code.google.com/p/snappy-java/
Path to vulnerable library: /root/.ivy2/cache/org.xerial.snappy/snappy-java/bundles/snappy-java-1.0.4.1.jar
Dependency Hierarchy: - hadoop-client-2.6.0-cdh5.9.0.jar (Root Library) - hadoop-aws-2.6.0-cdh5.9.0.jar - hadoop-common-2.6.0-cdh5.9.0.jar - avro-1.7.6-cdh5.9.0.jar - :x: **snappy-java-1.0.4.1.jar** (Vulnerable Library)
Found in base branch: master
snappy-java is a fast compressor/decompressor for Java. Due to unchecked multiplications, an integer overflow may occur in versions prior to 1.1.10.1, causing a fatal error. The function `shuffle(int[] input)` in the file `BitShuffle.java` receives an array of integers and applies a bit shuffle on it. It does so by multiplying the length by 4 and passing it to the natively compiled shuffle function. Since the length is not tested, the multiplication by four can cause an integer overflow and become a smaller value than the true size, or even zero or negative. In the case of a negative value, a `java.lang.NegativeArraySizeException` exception will raise, which can crash the program. In a case of a value that is zero or too small, the code that afterwards references the shuffled array will assume a bigger size of the array, which might cause exceptions such as `java.lang.ArrayIndexOutOfBoundsException`. The same issue exists also when using the `shuffle` functions that receive a double, float, long and short, each using a different multiplier that may cause the same issue. Version 1.1.10.1 contains a patch for this vulnerability.
Publish Date: 2023-06-15
URL: CVE-2023-34453
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here.Type: Upgrade version
Origin: https://github.com/xerial/snappy-java/security/advisories/GHSA-pqr6-cmr2-h8hf
Release Date: 2023-06-15
Fix Resolution (org.xerial.snappy:snappy-java): 1.1.10.1
Direct dependency fix Resolution (org.apache.hadoop:hadoop-client): 2.6.1
Step up your Open Source Security Game with Mend here