Skip to content
CVE PROGRAM SOURCE RECORD5.9 Medium

CVE-2023-3635

Okio GzipSource unhandled exception Denial of Service

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
JFROG

Description

GzipSource does not handle an exception that might be raised when parsing a malformed gzip buffer. This may lead to denial of service of the Okio client when handling a crafted GZIP archive, by using the GzipSource class.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

com.squareup.okio:okio

Default version status: unaffected

  • 0.5.0 to < 1.0.0affected
  • 1.0.0 to < 1.17.6affected
  • 2.0.0 to < 3.0.0affected
  • 3.0.0 to < 3.4.0affected

References