PT-2020-22674 · Blosc · C-Blosc2

Published 2020-11-27 · Updated 2020-11-27

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Blosc C-Blosc2 versions through 2.0.0.beta.5

Description The issue arises from a heap-based buffer overflow in the blosc2.c file when there is insufficient space to write compressed data.

Recommendations For versions through 2.0.0.beta.5, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

PYSEC-2020-343

Affected Products

C-Blosc2

References · 3

• https://osv.dev/vulnerability/PYSEC-2020-343 · Vendor Advisory
• https://github.com/Blosc/c-blosc2/commit/c4c6470e88210afc95262c8b9fcc27e30ca043ee · Note
• https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26442 · Note