安全公告/【CVE-2023-43642】

基本信息

漏洞名称:
受影响操作系统:Asianux
危险等级:高危
影响源码包:snappy-java
CVSS评分:7.5
发现日期:2023-10-11
修复日期:
修复版本:snappy-java-1.1.2.4-3

漏洞描述

snappy-java is a Java port of the snappy, a fast C++ compresser/decompresser developed by Google. The SnappyInputStream was found to be vulnerable to Denial of Service (DoS) attacks when decompressing data with a too large chunk size. Due to missing upper bound check on chunk length, an unrecoverable fatal error can occur. All versions of snappy-java including the latest released version 1.1.10.3 are vulnerable to this issue. A fix has been introduced in commit `9f8c3cf74` which will be included in the 1.1.10.4 release. Users are advised to upgrade. Users unable to upgrade should only accept compressed data from trusted sources.

漏洞判定

执行命令yum info PackageName获取软件包版本号，版本小于修复版本，则受此漏洞影响，版本大于等于修复版本，则此漏洞已修复

修复方式

yum update PackageName

补丁

参考

https://gitee.com/src-openeuler/snappy-java/issues/I84B2Y
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-43642
https://nvd.nist.gov/vuln/detail/CVE-2023-43642