CVE-2023-22895

The bzip2 crate before 0.4.4 for Rust allow attackers to cause a denial of service via a large file that triggers an integer overflow in mem.rs. NOTE: this is unrelated to the https://crates.io/crates/bzip2-rs product.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
mitreCNA
---
---
CVEADP
---
---
CISA-ADPADP
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 26%
VendorProductVersion
bzip2_projectbzip2
𝑥
< 0.4.4
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
rust-bzip2
bullseye
no-dsa
buster
no-dsa
sid
0.4.4-1
fixed
trixie
0.4.4-1
fixed
bookworm
0.4.4-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
rust-bzip2
oracular
needs-triage
noble
needs-triage
mantic
ignored
lunar
ignored
kinetic
not-affected
jammy
needed
focal
needed
bionic
dne
xenial
ignored
trusty
ignored
Common Weakness Enumeration
References
https://crates.io/crates/bzip2/versions
https://github.com/alexcrichton/bzip2-rs/pull/86
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MI5SVRSGKBWB2JGDLDVIFY5ZQVDZP6I7/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SQK57GGXJX3AH7KF6S7S3N7JC5QOYUQ7/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UUK2JO25PPA6XBREKJRBLRCD22LKIOLO/
https://crates.io/crates/bzip2/versions
https://github.com/alexcrichton/bzip2-rs/pull/86
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MI5SVRSGKBWB2JGDLDVIFY5ZQVDZP6I7/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SQK57GGXJX3AH7KF6S7S3N7JC5QOYUQ7/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UUK2JO25PPA6XBREKJRBLRCD22LKIOLO/