okio:1.15.0 library's vulnerability issue in Split.IO Android & Flutter

[rastogitech]

• Static scan of SplitIO-Android SDK gives warning on the usage of com.squareup.okio:okio:1.15.0 (being added from com.squareup.okhttp3:okhttp:3.12.13 lib) and recommends upgrading to com.squareup.okio:okio-jvm:3.4.0.

The static scan gives error:

• GzipSource does not handle an exception that might be raised when parsing a malformed gzip buffer. This may lead to denial of service of the Okio client when handling a crafted GZIP archive, by using the GzipSource class.

More details:

• https://www.cve.org/CVERecord?id=CVE-2023-3635
• https://research.jfrog.com/vulnerabilities/okio-gzip-source-unhandled-exception-dos-xray-523195/

[rastogitech]

Please suggest if this is a red herring or can be a potential issue.

[gthea]

Hi @rastogitech, apologies for the late response. 0.1.8 was released with a fix for this issue.

Feel free to reopen in case you have further questions.