Bug#1053474: snappy-java: CVE-2023-43642

2023-10-05 Thread tony mancill
On Wed, Oct 04, 2023 at 09:41:10PM +0200, Salvatore Bonaccorso wrote:
> Source: snappy-java
> Version: 1.1.8.3-1
> Severity: important
> Tags: security upstream
> X-Debbugs-Cc: car...@debian.org, Debian Security Team 
> 
> 
> The following vulnerability was published for snappy-java.
> 
> CVE-2023-43642[0]:
>
> ...(SNIP)...
> 
> For further information see:
> 
> [0] https://security-tracker.debian.org/tracker/CVE-2023-43642
> https://www.cve.org/CVERecord?id=CVE-2023-43642
> [1] 
> https://github.com/xerial/snappy-java/commit/9f8c3cf74223ed0a8a834134be9c917b9f10ceb5
> [2] 
> https://github.com/xerial/snappy-java/security/advisories/GHSA-55g7-9cwv-5qfv

The latest upstream version 1.1.10.5 has been uploaded to unstable.

I will look into what is required to apply the patch referenced above
against 1.1.8.3 for bookworm and bullseye.



signature.asc
Description: PGP signature


Bug#1053474: snappy-java: CVE-2023-43642

2023-10-04 Thread Salvatore Bonaccorso
Source: snappy-java
Version: 1.1.8.3-1
Severity: important
Tags: security upstream
X-Debbugs-Cc: car...@debian.org, Debian Security Team 

Hi,

The following vulnerability was published for snappy-java.

CVE-2023-43642[0]:
| snappy-java is a Java port of the snappy, a fast C++
| compresser/decompresser developed by Google. The SnappyInputStream
| was found to be vulnerable to Denial of Service (DoS) attacks when
| decompressing data with a too large chunk size. Due to missing upper
| bound check on chunk length, an unrecoverable fatal error can occur.
| All versions of snappy-java including the latest released version
| 1.1.10.3 are vulnerable to this issue. A fix has been introduced in
| commit `9f8c3cf74` which will be included in the 1.1.10.4 release.
| Users are advised to upgrade. Users unable to upgrade should only
| accept compressed data from trusted sources.

Please double check as mainly filling the issue to make you aware of
the upstream issue.

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2023-43642
https://www.cve.org/CVERecord?id=CVE-2023-43642
[1] 
https://github.com/xerial/snappy-java/commit/9f8c3cf74223ed0a8a834134be9c917b9f10ceb5
[2] 
https://github.com/xerial/snappy-java/security/advisories/GHSA-55g7-9cwv-5qfv

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore