Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2023-3635
CVE-2023-3635:
Java vulnerability analysis and mitigation
Overview
GzipSource in SquareUp Okio prior to version 3.4.0 contains a vulnerability where it does not handle an exception that might be raised when parsing a malformed gzip buffer. The vulnerability was assigned CVE-2023-3635 and was discovered in July 2023. The affected software includes all versions of Okio before 3.4.0 (NVD).
Technical details
The vulnerability stems from improper exception handling in the GzipSource class when parsing malformed gzip buffers. The issue specifically relates to how the code treats short values as unsigned when they should have been treated as signed. The vulnerability has a CVSS v3.1 base score of 7.5 (High), with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (NVD, GitHub Patch).
Impact
The vulnerability can lead to a denial of service (DoS) condition of the Okio client when handling a crafted GZIP archive. This affects the availability of systems using the vulnerable versions of the Okio library (NVD).
Mitigation and workarounds
The recommended mitigation is to upgrade to Okio version 3.4.0 or later, which contains the fix for this vulnerability. The fix involves correcting how the code handles short values in the GzipSource class (GitHub Patch).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management