Homepage
About Snyk

Out-of-bounds Read Affecting io.airlift:aircompressor package, versions [,0.27)

Severity

 Recommended
0.0
high
0
10

CVSS assessment made by Snyk's Security Team

    Threat Intelligence

    EPSS
    0.05% (16th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-JAVA-IOAIRLIFT-7164637
  • published 30 May 2024
  • disclosed 29 May 2024
  • credit Marcono1234
Report a new vulnerability Found a mistake?

Introduced: 29 May 2024

New CVE-2024-36114 Open this link in a new tab
CWE-125 Open this link in a new tab

How to fix?

Upgrade io.airlift:aircompressor to version 0.27 or higher.

Overview

Affected versions of this package are vulnerable to Out-of-bounds Read via the decompression process due to improper input length validation in the functions SnappyRawDecompressor.readUncompressedLengt, SnappyRawDecompressor.uncompressAll, ZstdFrameDecompressor.decompress, Lz4RawDecompressor.decompress and LzoRawDecompressor.decompress.

By exploiting this vulnerability, an attacker can crash the JVM or leak sensitive information by decompressing specially crafted data from untrusted sources.

CVSS Scores

version 3.1
Expand this section

Snyk

8.2 high
  • Attack Vector (AV)
    Network
  • Attack Complexity (AC)
    Low
  • Privileges Required (PR)
    None
  • User Interaction (UI)
    None
  • Scope (S)
    Unchanged
  • Confidentiality (C)
    Low
  • Integrity (I)
    None
  • Availability (A)
    High