CVE-2023-3635
12.07.2023, 19:15
GzipSource does not handle an exception that might be raised when parsing a malformed gzip buffer. This may lead to denial of service of the Okio client when handling a crafted GZIP archive, by using the GzipSource class.Enginsight
| Vendor | Product | Version |
|---|---|---|
| squareup | okio | 0.5.0 ≤ 𝑥 < 1.17.6 |
| squareup | okio | 2.0.0 ≤ 𝑥 < 3.4.0 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
Common Weakness Enumeration
- CWE-195 - Signed to Unsigned Conversion ErrorThe software uses a signed primitive and performs a cast to an unsigned primitive, which can produce an unexpected value if the value of the signed primitive can not be represented using an unsigned primitive.
- CWE-681 - Incorrect Conversion between Numeric TypesWhen converting from one data type to another, such as long to integer, data can be omitted or translated in a way that produces unexpected values. If the resulting values are used in a sensitive context, then dangerous behaviors may occur.
References