PT-2023-4786 · Atlassian · Confluence+2

Published 2023-07-12 · Updated 2024-01-16 · CVE-2023-3635

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Okio versions prior to the fixed versions Bitbucket Data Center and Server versions 7.17.0 through 8.14.0 Confluence Data Center and Server versions 7.13.0 through 8.7.0

Description The issue is related to the GzipSource class in the Okio library, which does not handle exceptions that may be raised when parsing a malformed gzip buffer. This can lead to a denial of service of the Okio client when handling a crafted GZIP archive. An unauthenticated attacker can exploit this issue, which has no impact on confidentiality and integrity but has a high impact on availability and requires no user interaction.

Recommendations For Bitbucket Data Center and Server 7.21, upgrade to a release greater than or equal to 7.21.18 For Bitbucket Data Center and Server 8.9, upgrade to a release greater than or equal to 8.9.7 For Bitbucket Data Center and Server 8.11, upgrade to a release greater than or equal to 8.11.6 For Bitbucket Data Center and Server 8.12, upgrade to a release greater than or equal to 8.12.4 For Bitbucket Data Center and Server 8.13, upgrade to a release greater than or equal to 8.13.3 For Bitbucket Data Center and Server 8.14, upgrade to a release greater than or equal to 8.14.2 For Confluence Data Center and Server 7.19, upgrade to a release 7.19.17 or any higher 7.19.x release For Confluence Data Center and Server 8.5, upgrade to a release 8.5.4 or any higher 8.5.x release For Confluence Data Center 8.6, upgrade to a release 8.6.2 or any higher 8.6.x release For Confluence Data Center 8.7, upgrade to a release 8.7.1 or any higher release As a temporary workaround, consider disabling the GzipSource class until a patch is available.

Exploit

Fix

DoS

Weakness Enumeration

CWE-681

CWE-195

Related Identifiers

BDU:2023-05234

CVE-2023-3635

GHSA-W33C-445M-F8W7

Affected Products

Bitbucket

Bitbucket Server

Confluence

References · 24

• 🔥 https://research.jfrog.com/vulnerabilities/okio-gzip-source-unhandled-exception-dos-xray-523195 · Exploit
• https://github.com/square/okio/commit/81bce1a30af244550b0324597720e4799281da7b · Patch
• https://bdu.fstec.ru/vul/2023-05234 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-3635 · Security Note
• https://ubuntu.com/security/CVE-2023-3635 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-3635 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-3635 · Security Note
• https://osv.dev/vulnerability/CVE-2023-3635 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-3635 · Security Note
• https://osv.dev/vulnerability/GHSA-w33c-445m-f8w7 · Vendor Advisory
• https://github.com/square/okio/pull/1334 · Note
• https://github.com/square/okio · Note
• https://github.com/square/okio/pull/1280 · Note
• https://github.com/square/okio/blob/master/CHANGELOG.md#version-1176 · Note
• https://github.com/square/okio/commit/b4fa875dc24950680c386e4b1c593660ce4f7839 · Note