Описание
LZ4 Java Compression has Out-of-bounds memory operations which can cause DoS
Out-of-bounds memory operations in org.lz4:lz4-java 1.8.0 and earlier allow remote attackers to cause denial of service and read adjacent memory via untrusted compressed input.
This is fixed in a forked release: at.yawk.lz4:lz4-java version 1.8.1. The original project has been archived: https://github.com/lz4/lz4-java, and Sonatype has added a redirect from org.lz4:lz4-java:1.8.1 to the new group ID.
Пакеты
at.yawk.lz4:lz4-java
< 1.8.1
1.8.1
org.lz4:lz4-java
< 1.8.1
1.8.1
org.lz4:lz4-pure-java
<= 1.8.0
Отсутствует
net.jpountz.lz4:lz4
<= 1.3.0
Отсутствует
Связанные уязвимости
Out-of-bounds memory operations in org.lz4:lz4-java 1.8.0 and earlier allow remote attackers to cause denial of service and read adjacent memory via untrusted compressed input.
Out-of-bounds memory operations in org.lz4:lz4-java 1.8.0 and earlier allow remote attackers to cause denial of service and read adjacent memory via untrusted compressed input.
Out-of-bounds memory operations in org.lz4:lz4-java 1.8.0 and earlier ...
Уязвимость функции LZ4_decompress_fast() библиотеки для сжатия данных lz4-java, позволяющая нарушителю вызвать отказ в обслуживании и раскрыть защищаемую информацию