CVE-2023-3635 is a high-severity vulnerability affecting the Okio library, specifically versions 0.5.0 to 1.17.6 and 2.0.0 to 3.4.0. This vulnerability occurs when GzipSource doesn't handle an exception that might be raised when parsing a malformed gzip buffer, leading to a denial of service for the Okio client when handling a crafted GZIP archive using the GzipSource class.

How do I know if I'm affected?

To determine if you're affected by the CVE-2023-3635 vulnerability, check if your system uses the Okio library, specifically versions 0.5.0 to 1.17.6 or 2.0.0 to 3.4.0. This vulnerability can cause a denial of service when handling a crafted GZIP archive with the GzipSource class. If your system utilizes any of the mentioned Okio library versions, it may be vulnerable.

What should I do if I'm affected?

If you're affected by this vulnerability, update your Okio library to a version outside the vulnerable range. To do this, visit the Okio GitHub repository and follow the instructions to update your library. This will help protect your system from potential denial of service attacks.

Is this in CISA’s Known Exploited Vulnerabilities Catalog?

The CVE-2023-3635 vulnerability, also known as GzipSource's exception handling issue, is not listed in CISA's Known Exploited Vulnerabilities Catalog. As a high-severity vulnerability, it's crucial to update your Okio library to a secure version to prevent potential denial of service attacks. Stay informed and take appropriate actions to mitigate the vulnerability.

Weakness enumeration

The CVE-2023-3635 vulnerability involves weaknesses in numeric type conversions, specifically CWE-681 and CWE-195. A bug fix addressing xlen rejection has been implemented to mitigate the issue.

For more details

CVE-2023-3635 is a high-severity vulnerability affecting the Okio library, with potential denial of service implications. For a comprehensive understanding of the vulnerability, including its description, severity, technical details, and known affected software configurations, refer to the NVD page or the links below.

• GitHub Commit

• JFrog Security Research (404)