cvelistv5 - cve-2024-36124

cve-2024-36124

Vulnerability from cvelistv5

Published

2024-06-03 14:25

Modified

2024-09-05 14:44

Severity ?

5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Summary

iq80 Snappy is a compression/decompression library. When uncompressing certain data, Snappy tries to read outside the bounds of the given byte arrays. Because Snappy uses the JDK class `sun.misc.Unsafe` to speed up memory access, no additional bounds checks are performed and this has similar security consequences as out-of-bounds access in C or C++, namely it can lead to non-deterministic behavior or crash the JVM. iq80 Snappy is not actively maintained anymore. As quick fix users can upgrade to version 0.5.

References

▼	URL	Tags
	security-advisories@github.com	https://github.com/dain/snappy/security/advisories/GHSA-8wh2-6qhj-h7j9
	af854a3a-2127-422b-91ae-364da2661108	https://github.com/dain/snappy/security/advisories/GHSA-8wh2-6qhj-h7j9

Impacted products

Vendor

Product

Version

▼

dain

snappy

Version: < 0.5

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:30:13.077Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/dain/snappy/security/advisories/GHSA-8wh2-6qhj-h7j9",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/dain/snappy/security/advisories/GHSA-8wh2-6qhj-h7j9"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:xerial:snappy-java:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "snappy-java",
            "vendor": "xerial",
            "versions": [
              {
                "lessThan": "0.5",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-36124",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-06T18:26:25.852205Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-05T14:44:12.984Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "snappy",
          "vendor": "dain",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "iq80 Snappy is a compression/decompression library. When uncompressing certain data, Snappy tries to read outside the bounds of the given byte arrays. Because Snappy uses the JDK class `sun.misc.Unsafe` to speed up memory access, no additional bounds checks are performed and this has similar security consequences as out-of-bounds access in C or C++, namely it can lead to non-deterministic behavior or crash the JVM. iq80 Snappy is not actively maintained anymore. As quick fix users can upgrade to version 0.5.\n"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "CWE-125: Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-06-03T14:25:58.628Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/dain/snappy/security/advisories/GHSA-8wh2-6qhj-h7j9",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/dain/snappy/security/advisories/GHSA-8wh2-6qhj-h7j9"
        }
      ],
      "source": {
        "advisory": "GHSA-8wh2-6qhj-h7j9",
        "discovery": "UNKNOWN"
      },
      "title": "iq80 Snappy has an out-of-bounds read when uncompressing data, leading to JVM crash"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-36124",
    "datePublished": "2024-06-03T14:25:58.628Z",
    "dateReserved": "2024-05-20T21:07:48.189Z",
    "dateUpdated": "2024-09-05T14:44:12.984Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-36124\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2024-06-03T15:15:09.090\",\"lastModified\":\"2024-11-21T09:21:40.357\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"iq80 Snappy is a compression/decompression library. When uncompressing certain data, Snappy tries to read outside the bounds of the given byte arrays. Because Snappy uses the JDK class `sun.misc.Unsafe` to speed up memory access, no additional bounds checks are performed and this has similar security consequences as out-of-bounds access in C or C++, namely it can lead to non-deterministic behavior or crash the JVM. iq80 Snappy is not actively maintained anymore. As quick fix users can upgrade to version 0.5.\\n\"},{\"lang\":\"es\",\"value\":\"iq80 Snappy es una librer\u00eda de compresi\u00f3n/descompresi\u00f3n. Al descomprimir ciertos datos, Snappy intenta leer fuera de los l\u00edmites de las matrices de bytes dadas. Debido a que Snappy usa la clase JDK `sun.misc.Unsafe` para acelerar el acceso a la memoria, no se realizan comprobaciones de los l\u00edmites adicionales y esto tiene consecuencias de seguridad similares a las del acceso fuera de los l\u00edmites en C o C++, es decir, puede conducir a no comportamiento determinista o bloquear la JVM. iq80 Snappy ya no recibe mantenimiento activo. Como soluci\u00f3n r\u00e1pida, los usuarios pueden actualizar a la versi\u00f3n 0.5.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":3.9,\"impactScore\":1.4}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-125\"}]}],\"references\":[{\"url\":\"https://github.com/dain/snappy/security/advisories/GHSA-8wh2-6qhj-h7j9\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/dain/snappy/security/advisories/GHSA-8wh2-6qhj-h7j9\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}"
  }
}

ghsa-8wh2-6qhj-h7j9

Vulnerability from github

Published

2024-06-04 17:38

Modified

2024-06-04 17:38

Severity ?

5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Summary

iq80 Snappy out-of-bounds read when uncompressing data, leading to JVM crash

Details

Summary

iq80 Snappy performs out-of-bounds read access when uncompressing certain data, which can lead to a JVM crash.

Details

When uncompressing certain data, Snappy tries to read outside the bounds of the given byte arrays. Because Snappy uses the JDK class sun.misc.Unsafe to speed up memory access, no additional bounds checks are performed and this has similar security consequences as out-of-bounds access in C or C++, namely it can lead to non-deterministic behavior or crash the JVM.

iq80 Snappy is not actively maintained anymore. As quick fix users can upgrade to version 0.5, but in the long term users should prefer migrating to the Snappy implementation in https://github.com/airlift/aircompressor (version 0.27 or newer).

Impact

When uncompressing data from untrusted users, this can be exploited for a denial-of-service attack by crashing the JVM.

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.iq80.snappy:snappy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-36124"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-125"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-06-04T17:38:31Z",
    "nvd_published_at": "2024-06-03T15:15:09Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\niq80 Snappy performs out-of-bounds read access when uncompressing certain data, which can lead to a JVM crash.\n\n### Details\nWhen uncompressing certain data, Snappy tries to read outside the bounds of the given byte arrays. Because Snappy uses the JDK class `sun.misc.Unsafe` to speed up memory access, no additional bounds checks are performed and this has similar security consequences as out-of-bounds access in C or C++, namely it can lead to non-deterministic behavior or crash the JVM.\n\niq80 Snappy is not actively maintained anymore. As quick fix users can upgrade to version 0.5, but in the long term users should prefer migrating to the Snappy implementation in https://github.com/airlift/aircompressor (version 0.27 or newer).\n\n### Impact\nWhen uncompressing data from untrusted users, this can be exploited for a denial-of-service attack by crashing the JVM.\n",
  "id": "GHSA-8wh2-6qhj-h7j9",
  "modified": "2024-06-04T17:38:31Z",
  "published": "2024-06-04T17:38:31Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/dain/snappy/security/advisories/GHSA-8wh2-6qhj-h7j9"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-36124"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/dain/snappy"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "iq80 Snappy out-of-bounds read when uncompressing data, leading to JVM crash"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

cve-2024-36124

Vulnerability from cvelistv5

ghsa-8wh2-6qhj-h7j9

Vulnerability from github

Summary

Details

Impact

Tags

Sightings

Nomenclature