Bug 2229295 (CVE-2023-3635)

Summary:	CVE-2023-3635 okio: GzipSource class improper exception handling
Product:	[Other] Security Response	Reporter:	Pedro Sampaio <psampaio>
Component:	vulnerability	Assignee:	Nobody <nobody>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	aazores, aileenc, alampare, alazarot, anstephe, aschwart, asoldano, avibelli, bbaranow, bgeorges, bmaxwell, boliveir, brian.stansberry, caswilli, cdewolf, chazlett, chfoley, cmah, cmoulliard, crizzo, darran.lofthouse, dfreiber, dhanak, dkreling, dnakabaa, dosoudil, drichtar, drosa, drow, eaguilar, ebaron, emingora, eric.wittmann, fjansen, fjuma, ggrzybek, gjospin, gmalinko, gtanzill, ibek, istudens, ivassile, iweiss, janstey, jburrell, jbuscemi, jkang, jolong, jpallich, jrokos, jsamir, jscholz, kaycoth, kholdawa, kverlaen, lbacciot, lcouzens, lgao, lthon, mnovotny, mosmerov, mposolda, mskarbek, msochure, mstefank, msvehla, nboldt, nipatil, nwallace, pantinor, pdelbell, pdrozd, peholase, pesilva, pgallagh, pjindal, pmackay, pskopek, rguimara, rkubis, rogbas, rowaters, rruss, rstancel, rstepani, sausingh, sdawley, sfroberg, smaestri, ssilvert, sthirugn, sthorger, swoodman, tom.jenkinson, vkrizan, vkumar, vmuzikar
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	okio 3.4.0, okio 3.5.0	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in SquareUp Okio. A class GzipSource does not handle an exception that might be raised when parsing a malformed gzip buffer. This issue may allow a malicious user to start processing a malformed file, which can result in a Denial of Service (DoS).	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2229296

Description Pedro Sampaio 2023-08-04 19:27:10 UTC

GzipSource does not handle an exception that might be raised when parsing a malformed gzip buffer. This may lead to denial of service of the Okio client when handling a crafted GZIP archive, by using the GzipSource class.

References:

https://github.com/square/okio/commit/81bce1a30af244550b0324597720e4799281da7b
https://research.jfrog.com/vulnerabilities/okio-gzip-source-unhandled-exception-dos-xray-523195/

Comment 10 errata-xmlrpc 2023-09-14 09:51:53 UTC

This issue has been addressed in the following products:

  Red Hat AMQ Streams 2.5.0

Via RHSA-2023:5165 https://access.redhat.com/errata/RHSA-2023:5165

Comment 12 errata-xmlrpc 2023-11-15 17:07:52 UTC

This issue has been addressed in the following products:

  Red Hat Fuse 7.12.1

Via RHSA-2023:7247 https://access.redhat.com/errata/RHSA-2023:7247

Comment 15 errata-xmlrpc 2024-03-18 09:48:24 UTC

This issue has been addressed in the following products:

  RHPAM 7.13.5 async

Via RHSA-2024:1353 https://access.redhat.com/errata/RHSA-2024:1353

Comment 16 errata-xmlrpc 2024-05-28 11:19:55 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform

Via RHSA-2024:3385 https://access.redhat.com/errata/RHSA-2024:3385