Integer overflow in snappy-java - CVE-2023-34454

Vulnerability identifier: #VU77361

CSH Severity: Medium

CVSS v4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-34454

CWE-ID: CWE-190

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to integer overflow in compress. A remote attacker can pass specially crafted data to the application, trigger integer overflow and cause a denial of service condition on the target system.

snappy-java
Guardium Data Security Center (GDSC)
Cloudera Observability with IBM
IBM Engineering Requirements Management DOORS Next
IBM Application Suite - IBM Asset Data Dictionary Component
ObjectScale
Netezza Performance Server Replication Services
IBM Cloud Pak for Watson AIOps
IBM Business Automation Manager Open Editions
webMethods BPM
InfoSphere Data Replication
IBM Integration Bus
IBM Operations Analytics Predictive Insights
IBM Spectrum Copy Data Management
IBM Sterling B2B Integrator
Jira Software Data Center
Log Analysis
Netcool Operations Insight
Red Hat build of Quarkus
QRadar User Behavior Analytics
IBM Watson Knowledge Catalog in Cloud Pak for Data
App Connect Enterprise Certified Container
IBM Maximo Asset Management
IBM Cloud Application Performance Management (APM)
IBM Maximo Application Suite
IBM Spectrum Protect Plus
IBM InfoSphere Information Server for Cloud
IBM Business Automation Workflow
IBM Cloud Pak for Business Automation
IBM Observability with Instana
watsonx.data
IBM Data Risk Manager
IBM Db2 Web Query for i
IBM Qradar SIEM
Jira Software Server
Event Streams
Juniper Secure Analytics (JSA)
Splunk Enterprise
IBM App Connect Enterprise
IBM Security Guardium
openEuler
snappy-java-javadoc
snappy-java
IBM Disconnected Log Collector
AMQ Streams
IBM InfoSphere Information Server

Install updates from vendor's website.

snappy-java - update to 1.1.10.1
IBM Operations Analytics Predictive Insights - update to 1.3.6.8
watsonx.data - update to 2.0.2
IBM Data Risk Manager - update to 2.0.6.18
IBM Spectrum Copy Data Management - update to 2.2.21.0
Guardium Data Security Center (GDSC) - addressed in versions 3.6.1, 3.8.5
Cloudera Observability with IBM - update to 3.6.2
IBM Sterling B2B Integrator - addressed in versions 6.0.3.9, 6.1.0.8, 6.1.2.4, 6.2.0.0
IBM Qradar SIEM - update to 7.5.0 Update Pack 7
Juniper Secure Analytics (JSA) - update to 7.5.0 UP7 IF04
Jira Software Server - addressed in versions 9.4.16, 9.12.3
Splunk Enterprise - addressed in versions 9.0.9, 9.1.4, 9.2.1
Jira Software Data Center - addressed in versions 9.4.16, 9.12.3
IBM Engineering Requirements Management DOORS Next - update to 9.7.2.8
snappy-java-javadoc - update to 1.1.2.4-2
snappy-java - update to 1.1.2.4-2
IBM Application Suite - IBM Asset Data Dictionary Component - update to 1.1.8
Log Analysis - update to 1.3.8 Fix Pack 1
ObjectScale - update to 1.4.0
Netcool Operations Insight - update to 1.6.11
IBM Disconnected Log Collector - update to 1.8.4
AMQ Streams - update to 2.5.0
Red Hat build of Quarkus - update to 2.13.9
Netezza Performance Server Replication Services - update to 3.0.5.0
IBM Cloud Pak for Watson AIOps - update to 4.1.2
QRadar User Behavior Analytics - update to 4.1.16
IBM Watson Knowledge Catalog in Cloud Pak for Data - update to 4.7.1
App Connect Enterprise Certified Container - addressed in versions 5.0.9, 9.1.0
IBM Maximo Asset Management - addressed in versions 7.6.1.2.36, 7.6.1.3.11
IBM Business Automation Manager Open Editions - update to 8.0.6
IBM Cloud Application Performance Management (APM) - update to 8.1.4.0.15
IBM Maximo Application Suite - addressed in versions 8.9.6, 8.10.4
IBM Spectrum Protect Plus - update to 10.1.6.4
webMethods BPM - update to 11.1 Fix 9
Event Streams - update to 11.2.3
InfoSphere Data Replication - update to 11.4.0.5.5702
IBM InfoSphere Information Server for Cloud - update to 11.7.1.4 Service pack 1
IBM InfoSphere Information Server - update to 11.7.1.4 Service pack 1
IBM Business Automation Workflow - addressed in versions 21.0.3 IF024, 23.0.1 IF002
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3.24, 23.0.1.2
IBM Observability with Instana - update to 266

• https://github.com/xerial/snappy-java/releases/tag/v1.1.10.1
• https://github.com/xerial/snappy-java/security/advisories/GHSA-fjpj-2g6w-x25r

• Multiple vulnerabilities in snappy-java
• Multiple vulnerabilities in IBM InfoSphere Information Server
• Multiple vulnerabilities in IBM Maximo Application Suite - Monitor Component
• Multiple vulnerabilities in IBM App Connect Enterprise Certified Container
• Multiple vulnerabilities in IBM Watson Knowledge Catalog for IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM App Connect Enterprise and IBM Integration Bus
• Multiple vulnerabilities in IBM Business Automation Workflow
• Multiple vulnerabilities in IBM Event Streams
• Multiple Vulnerabilities in IBM CloudPak for Watson AIOps
• Multiple vulnerabilities in IBM Data Risk Manager
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation
• Multiple vulnerabilities in Red Hat AMQ Streams
• Multiple vulnerabilities in IBM Spectrum Copy Data Management
• Multiple vulnerabilities in IBM QRadar SIEM
• Multiple vulnerabilities in IBM Maximo Asset Management
• Multiple vulnerabilities in IBM Security Guardium
• Multiple vulnerabilities in Red Hat build of Quarkus 2.13
• Multiple vulnerabilities in IBM Netcool Operations Insight
• Multiple vulnerabilities in IBM Disconnected Log Collector
• Juniper Networks Juniper Secure Analytics update for third-party applications
• Multiple vulnerabilities in IBM Observability with Instana
• Multiple vulnerabilities in IBM Sterling B2B Integrator
• Multiple vulnerabilities in IBM Application Performance Management
• Multiple vulnerabilities in IBM Engineering Requirements Management DOORS/DWA
• openEuler update for snappy-java
• Multiple vulnerabilities in IBM Db2 Web Query for i
• Multiple vulnerabilities in IBM Operations Analytics - Log Analysis
• Jira Software Data Center and Server update for snappy-java
• Multiple vulnerabilities in IBM Operations Analytics Predictive Insights
• Multiple vulnerabilities in IBM QRadar User Behavior Analytics
• Multiple vulnerabilities in IBM Asset Data Dictionary Component
• Splunk Enterprise update for third-party components
• Multiple vulnerabilities in Dell ObjectScale
• Multiple vulnerabilities in IBM watsonx.data
• Multiple vulnerabilities in IBM Business Automation Manager Open Editions
• Multiple vulnerabilities in IBM Spectrum Protect Plus
• Multiple vulnerabilities in Guardium Data Security Center
• Multiple vulnerabilities in IBM InfoSphere Data Replication
• Multiple vulnerabilities in IBM Netezza Performance Server Replication Services
• Multiple vulnerabilities in Cloudera Observability on Premises with IBM
• Multiple vulnerabilities in IBM Guardium Data Security Center
• Multiple vulnerabilities in IBM webMethods BPM