CVE-2023-43642

CVSS 3.1 Score 7.5 of 10 (high)

Details

Published Sep 25, 2023
Updated: Sep 26, 2023
CWE ID 770

Summary

CVE-2023-43642 is a vulnerability affecting snappy-java, a Java port of the snappy compresser/decompresser developed by Google. The SnappyInputStream in snappy-java is vulnerable to Denial of Service (DoS) attacks when decompressing data with a chunk size that is too large. This can lead to an unrecoverable fatal error. All versions of snappy-java, including the latest release 1.1.10.3, are affected by this issue. A fix has been introduced in commit 9f8c3cf74 and will be included in the upcoming release 1.1.10.4. To remediate this vulnerability, users are advised to upgrade to the patched version. If upgrading is not possible, it is recommended to only accept compressed data from trusted sources. This vulnerability has a high severity level and poses a potential danger to organizations as it can be exploited remotely over a network, leading to service disruption or denial of service attacks on affected systems.

Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2023-43642 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options