Description
zstd-jni before 1.5.7-14 contains a use-after-free vulnerability where streams and contexts hold a dictionary's shared lock only during the load call, allowing the dictionary to be closed while still referenced. Attackers can close a dictionary after associating it with a stream or context, causing subsequent read or write operations to access freed native memory, resulting in silent data corruption or JVM crashes.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
luben zstd-jni
Default version status: unaffected
1.3.8-4 to < 1.5.7-14affected
pkg:maven/com.github.luben/zstd-jniReferences
- https://github.com/luben/zstd-jni/security/advisories/GHSA-947w-pxjj-c7m9 ↗
- https://github.com/luben/zstd-jni/commit/393d7311766abbc285b149302c0fe1f94b16d555 ↗
- https://github.com/luben/zstd-jni/commit/a560131d7834598afd9cea6b7c107bc88e915936 ↗
- https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/ZstdInputStreamNoFinalizer.java ↗
- https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/BaseZstdBufferDecompressingStreamNoFinalizer.java ↗
- https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14 ↗
- https://github.com/luben/zstd-jni/commit/0827ed02551bbd8d6f8e4bbff99d83bf50f91938 ↗
- https://github.com/luben/zstd-jni ↗
- https://www.vulncheck.com/advisories/zstd-jni-1.3.8-4-through-1.5.7-13-use-after-free-of-compression-and-decompression-dictionaries ↗