[CASSANDRA-18608] snappy-java vulnerability: CVE-2023-34455, CVE-2023-34454, CVE-2023-34453

• Type: Bug
• Status: Resolved
• Priority: Normal
• Resolution: Fixed
• Fix Version/s: 3.0.30, 3.11.16, 4.0.11, 4.1.3, 5.0-alpha1, 5.0
• Component/s: Feature/Compression
• Bug Category: Degradation - Other Exception
• Severity: Normal
• Complexity: Normal
• Discovered By: User Report
• Platform: All
• Since Version: NA

Source Control Link

https://github.com/apache/cassandra/commit/d99bccd6493ceb7aed4e05b05f81913ea876d855

Test and Documentation Plan

run CI

• Assignee: Brandon Williams
• Reporter: Brandon Williams

Authors

Brandon Williams

Reviewers

Berenguer Blasi

• Created: 18/Jun/23 13:37
• Updated: 12/Sep/23 13:02
• Resolved: 26/Jun/23 11:15

Description

Failing owasp:

https://nvd.nist.gov/vuln/detail/CVE-2023-34455

Due to use of an unchecked chunk length, an unrecoverable fatal error can occur in versions prior to 1.1.10.1.

https://nvd.nist.gov/vuln/detail/CVE-2023-34454

Due to unchecked multiplications, an integer overflow may occur in versions prior to 1.1.10.1, causing an unrecoverable fatal error.

https://nvd.nist.gov/vuln/detail/CVE-2023-34453

Due to unchecked multiplications, an integer overflow may occur in versions prior to 1.1.10.1, causing a fatal error.

Issue Links

• is duplicated by: CASSANDRA-18609 snappy-java vulnerability: CVE-2023-34453