snappy-java: snappy-java is a Java port of the snappy, a fast C++ compresser/decompresser developed by Google
CVE-2023-43642 is fixed in snappy-java on 1 platform, first by DEBIAN-CVE-2023-43642, released September 25, 2023. It is not reported as exploited. Patch Radar priority: High.
snappy-java is a Java port of the snappy, a fast C++ compresser/decompresser developed by Google. The SnappyInputStream was found to be vulnerable to Denial of Service (DoS) attacks when decompressing data with a too large chunk size. Due to missing upper bound check on chunk length, an unrecoverable fatal error can occur. All versions of snappy-java including the latest released version 1.1.10.3 are vulnerable to this issue. A fix has been introduced in commit `9f8c3cf74` which will be included in the 1.1.10.4 release. Users are advised to upgrade. Users unable to upgrade should only accept compressed data from trusted sources.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| snappy-java · Debian 13.5 (trixie) | 1.1.10.5-1 | DEBIAN-CVE-2023-43642 | Sep 25, 2023 |
| snappy-java · Debian 14 | 1.1.10.5-1 | DEBIAN-CVE-2023-43642 | Sep 25, 2023 |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.