GitHub Advisoryadvisory · Maven

GHSA-w33c-445m-f8w7 Okio Signed to Unsigned Conversion Error vulnerability

MEDIUM Published 2023-07-12 Modified 2023-07-13 Official page ↗
Aliases
CVE-2023-3635
Ecosystem
Maven
Packages
com.squareup.okio:okio, com.squareup.okio:okio-jvm
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-195, CWE-681
Reviewed
2023-07-13

Affected packages

• Maven com.squareup.okio:okio: >= 2.0.0-RC1, < 3.4.0 → fixed in 3.4.0 • Maven com.squareup.okio:okio: < 1.17.6 → fixed in 1.17.6 • Maven com.squareup.okio:okio-jvm: >= 2.0.0-RC1, < 3.4.0 → fixed in 3.4.0

Description

GzipSource does not handle an exception that might be raised when parsing a malformed gzip buffer. This may lead to denial of service of the Okio client when handling a crafted GZIP archive, by using the GzipSource class.

Related

Alias · CVE (1)

  • CVE-2023-3635 GzipSource does not handle an exception that might be raised when parsing a malformed gzip buffer. vulnerability

Weakness · CWE (2)

  • CWE-195 Signed to Unsigned Conversion Error weakness
  • CWE-681 Incorrect Conversion between Numeric Types weakness

References