deps: update dependency org.xerial.snappy:snappy-java to v1.1.10.4 [security]

[renovate-bot]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
org.xerial.snappy:snappy-java	1.1.10.3 -> 1.1.10.4

GitHub Vulnerability Alerts

CVE-2023-43642

Summary

snappy-java is a data compression library in Java. Its SnappyInputStream was found to be vulnerable to Denial of Service (DoS) attacks when decompressing data with a too-large chunk size. Due to missing upper bound check on chunk length, an unrecoverable fatal error can occur.

Scope

All versions of snappy-java including the latest released version 1.1.10.3. A fix is applied in 1.1.10.4

Details

While performing mitigation efforts related to CVE-2023-34455 in Confluent products, our Application Security team closely analyzed the fix that was accepted and merged into snappy-java version 1.1.10.1 in this commit. The check on line 421 only attempts to check if chunkSize is not a negative value. We believe that this is an inadequate fix as it misses an upper-bounds check for overly positive values such as 0x7FFFFFFF (or (2,147,483,647 in decimal) before actually attempting to allocate the provided unverified number of bytes via the “chunkSize” variable. This missing upper-bounds check can lead to the applications depending upon snappy-java to allocate an inappropriate number of bytes on the heap which can then cause an java.lang.OutOfMemoryError exception. Under some specific conditions and contexts, this can lead to a Denial-of-Service (DoS) attack with a direct impact on the availability of the dependent implementations based on the usage of the snappy-java library for compression/decompression needs.

PoC

Compile and run the following code:

package org.example;
import org.xerial.snappy.SnappyInputStream;

import java.io.*;

public class Main {

    public static void main(String[] args) throws IOException {
        byte[] data = {-126, 'S', 'N', 'A', 'P', 'P', 'Y', 0, 0, 0, 0, 0, 0, 0, 0, 0,(byte) 0x7f, (byte) 0xff, (byte) 0xff, (byte) 0xff};
        SnappyInputStream in = new SnappyInputStream(new ByteArrayInputStream(data));
        byte[] out = new byte[50];
        try {
            in.read(out);
        }
        catch (Exception ignored) {
        }
    }
}

Impact

Denial of Service of applications dependent on snappy-java especially if ExitOnOutOfMemoryError or CrashOnOutOfMemoryError is configured on the JVM.

Credits

Jan Werner, Mukul Khullar and Bharadwaj Machiraju from Confluent's Application Security team.

We kindly request for a new CVE ID to be assigned once you acknowledge this vulnerability.

---

Release Notes

xerial/snappy-java (org.xerial.snappy:snappy-java)

v1.1.10.4

Compare Source

What's Changed

Security Fix

• CVE-2023-43642 Fixed SnappyInputStream so as not to allocate too large memory when decompressing data with an extremely large chunk size by @​tunnelshade (code change)
  • This does not affect users only using Snappy.compress/uncompress methods

🚀 Features

• feature: Upgrade the internal snappy version to 1.1.10 (1.1.8 was wrongly used before) by @​xerial in https://github.com/xerial/snappy-java/pull/508
• Support JDK21 (no internal change)

🔗 Dependency Updates

• Update scalafmt-core to 3.7.11 by @​xerial-bot in https://github.com/xerial/snappy-java/pull/485
• Update sbt to 1.9.3 by @​xerial-bot in https://github.com/xerial/snappy-java/pull/483
• Update scalafmt-core to 3.7.12 by @​xerial-bot in https://github.com/xerial/snappy-java/pull/487
• Bump actions/checkout from 3 to 4 by @​dependabot in https://github.com/xerial/snappy-java/pull/502
• Update sbt to 1.9.4 by @​xerial-bot in https://github.com/xerial/snappy-java/pull/496
• Update scalafmt-core to 3.7.14 by @​xerial-bot in https://github.com/xerial/snappy-java/pull/501
• Update sbt to 1.9.6 by @​xerial-bot in https://github.com/xerial/snappy-java/pull/505
• Update native libraries by @​github-actions in https://github.com/xerial/snappy-java/pull/503

🛠 Internal Updates

• Update airframe-log to 23.7.4 by @​xerial-bot in https://github.com/xerial/snappy-java/pull/486
• Update airframe-log to 23.8.0 by @​xerial-bot in https://github.com/xerial/snappy-java/pull/488
• Update sbt-scalafmt to 2.5.2 by @​xerial-bot in https://github.com/xerial/snappy-java/pull/500
• Update airframe-log to 23.8.6 by @​xerial-bot in https://github.com/xerial/snappy-java/pull/497
• Update sbt-scalafmt to 2.5.1 by @​xerial-bot in https://github.com/xerial/snappy-java/pull/499
• Update airframe-log to 23.9.1 by @​xerial-bot in https://github.com/xerial/snappy-java/pull/504
• Update airframe-log to 23.9.2 by @​xerial-bot in https://github.com/xerial/snappy-java/pull/509

Other Changes

• Update NOTICE by @​imsudiproy in https://github.com/xerial/snappy-java/pull/492

Full Changelog: xerial/snappy-java@v1.1.10.3...v1.1.10.4

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate. View repository job log here.