PT-2023-4870 · Atlassian · Bitbucket Server+2
Srmish-Jfrog
·
Publicado
2023-06-15
·
Atualizado
2026-05-18
·
CVE-2023-34455
CVSS v2.0
7.8
Alta
| Vetor | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
snappy-java versions prior to 1.1.10.1
Description
The issue is related to the use of an unchecked chunk length in the
hasNextChunk function of the SnappyInputStream class, which can lead to an unrecoverable fatal error. This error occurs when the code attempts to read 4 bytes from the input stream and treats them as the length of the next chunk. If the compressed variable is null, a byte array is allocated with the size given by the input data. Since the code does not test the legality of the chunkSize variable, it is possible to pass a negative number or a huge positive value, which can cause the code to raise a java.lang.NegativeArraySizeException or a fatal java.lang.OutOfMemoryError.Recommendations
For snappy-java versions prior to 1.1.10.1, upgrade to version 1.1.10.1 or later to resolve the issue.
For Bitbucket Data Center and Server 7.21, upgrade to a release greater than or equal to 7.21.21.
For Bitbucket Data Center and Server 8.9, upgrade to a release greater than or equal to 8.9.5.
For Bitbucket Data Center and Server 8.13, upgrade to a release greater than or equal to 8.13.1.
Exploit
Correção
Allocation of Resources Without Limits
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Bitbucket
Bitbucket Server
Jira