org.xerial.snappy:snappy-java 1.1.9.0 vulnerabilities

Direct Vulnerabilities

Known vulnerabilities in the org.xerial.snappy:snappy-java package. This does not include vulnerabilities belonging to this package’s dependencies.

How to fix?

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

Fix for free

Vulnerability	Vulnerable Version
H Allocation of Resources Without Limits or Throttling Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to a missing upper bound check on chunk length in the `SnappyInputStream` function. An attacker can decompress data with an excessively large chunk size. How to fix Allocation of Resources Without Limits or Throttling? Upgrade `org.xerial.snappy:snappy-java` to version 1.1.10.4 or higher.	[,1.1.10.4)
M Integer Overflow or Wraparound Affected versions of this package are vulnerable to Integer Overflow or Wraparound via the function `compress(char[] input)` in `Snappy.java` due to improper validation of the array length. Exploiting this vulnerability is possible when the “buf” array compiled by the `maxCompressedLength` function is successfully allocated but its size might be too small to use for the compression, causing a fatal Access Violation error. Note: The issue most likely won’t occur when using a byte array since creating a byte array of size 0x80000000 (or any other negative value) is impossible in the first place. How to fix Integer Overflow or Wraparound? Upgrade `org.xerial.snappy:snappy-java` to version 1.1.10.1 or higher.	[,1.1.10.1)
H Denial of Service (DoS) Affected versions of this package are vulnerable to Denial of Service (DoS) via the `hasNextChunk` function due to improper validation of the `chunkSize` variable value. Exploiting this vulnerability is possible by passing a negative number (such as `0xFFFFFFFF`, which is -1), which will cause the code to raise a `java.lang.NegativeArraySizeException` exception. A worse case would happen when passing a huge positive value (such as `0x7FFFFFFF`), raising the fatal `java.lang.OutOfMemoryError` error. How to fix Denial of Service (DoS)? Upgrade `org.xerial.snappy:snappy-java` to version 1.1.10.1 or higher.	[,1.1.10.1)
M Integer Overflow or Wraparound Affected versions of this package are vulnerable to Integer Overflow or Wraparound via the `shuffle(int[] input)` function due to improper validation of the multiplications done on the input length. Exploiting this vulnerability is possible by passing negative, zero, float, very small, or very long values to the `shuffle` functions, which later on are multiplicated by four. A successful exploration results in “java.lang.ArrayIndexOutOfBoundsException" or “java.lang.NegativeArraySizeException” exceptions which can crash the program. How to fix Integer Overflow or Wraparound? Upgrade `org.xerial.snappy:snappy-java` to version 1.1.10.1 or higher.	[,1.1.10.1)

Vulnerability

Vulnerable Version

Allocation of Resources Without Limits or Throttling

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to a missing upper bound check on chunk length in the SnappyInputStream function. An attacker can decompress data with an excessively large chunk size.

How to fix Allocation of Resources Without Limits or Throttling?

Upgrade org.xerial.snappy:snappy-java to version 1.1.10.4 or higher.

[,1.1.10.4)

Integer Overflow or Wraparound

Affected versions of this package are vulnerable to Integer Overflow or Wraparound via the function compress(char[] input) in Snappy.java due to improper validation of the array length.

Exploiting this vulnerability is possible when the “buf” array compiled by the maxCompressedLength function is successfully allocated but its size might be too small to use for the compression, causing a fatal Access Violation error.

Note: The issue most likely won’t occur when using a byte array since creating a byte array of size 0x80000000 (or any other negative value) is impossible in the first place.

How to fix Integer Overflow or Wraparound?

Upgrade org.xerial.snappy:snappy-java to version 1.1.10.1 or higher.

[,1.1.10.1)

Denial of Service (DoS)

Affected versions of this package are vulnerable to Denial of Service (DoS) via the hasNextChunk function due to improper validation of the chunkSize variable value.

Exploiting this vulnerability is possible by passing a negative number (such as 0xFFFFFFFF, which is -1), which will cause the code to raise a java.lang.NegativeArraySizeException exception. A worse case would happen when passing a huge positive value (such as 0x7FFFFFFF), raising the fatal java.lang.OutOfMemoryError error.

How to fix Denial of Service (DoS)?

Upgrade org.xerial.snappy:snappy-java to version 1.1.10.1 or higher.

[,1.1.10.1)

Integer Overflow or Wraparound

Affected versions of this package are vulnerable to Integer Overflow or Wraparound via the shuffle(int[] input) function due to improper validation of the multiplications done on the input length. Exploiting this vulnerability is possible by passing negative, zero, float, very small, or very long values to the shuffle functions, which later on are multiplicated by four. A successful exploration results in “java.lang.ArrayIndexOutOfBoundsException" or “java.lang.NegativeArraySizeException” exceptions which can crash the program.

How to fix Integer Overflow or Wraparound?

Upgrade org.xerial.snappy:snappy-java to version 1.1.10.1 or higher.

[,1.1.10.1)

org.xerial.snappy:snappy-java@1.1.9.0 vulnerabilities

latest version

latest non vulnerable version

first published

latest version published

licenses detected

package manager

Direct Vulnerabilities

How to fix?