CVE-2023-3635

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-3635
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-3635.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2023-3635
Aliases
Downstream
Published
2023-07-12T18:34:31.609Z
Modified
2026-07-23T03:45:17.406305810Z
Severity
  • 5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Okio GzipSource unhandled exception Denial of Service
Details

GzipSource does not handle an exception that might be raised when parsing a malformed gzip buffer. This may lead to denial of service of the Okio client when handling a crafted GZIP archive, by using the GzipSource class.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/3xxx/CVE-2023-3635.json",
    "cwe_ids": [
        "CWE-195"
    ],
    "cna_assigner": "JFROG"
}
References

Affected packages

Git / github.com/lysine-dev/okio

Affected ranges

Type
GIT
Repo
https://github.com/lysine-dev/okio
Events
Introduced
21362a2634b287f3d2136327a56ebf1b9738a7ae
Introduced
34810dbc73a94ff6c355b9c815645a78089b62a0
Introduced
2fcb42e6ffb8bef849e405d4e2ed186607fbf919
Introduced
4214975504671560b203c57954041c49c0dc7451
Fixed
34810dbc73a94ff6c355b9c815645a78089b62a0
Fixed
7599853576e32987fd1a99fc6d36b2b3e655451e
Fixed
4214975504671560b203c57954041c49c0dc7451
Fixed
a161b07fb1b459371458ae6d9508ec31df280428
Fixed
81bce1a30af244550b0324597720e4799281da7b
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0.5.0"
        },
        {
            "fixed": "1.0.0"
        },
        {
            "introduced": "1.0.0"
        },
        {
            "fixed": "1.17.6"
        },
        {
            "introduced": "2.0.0"
        },
        {
            "fixed": "3.0.0"
        },
        {
            "introduced": "3.0.0"
        },
        {
            "fixed": "3.4.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

2.*
2.2.2
2.4.1
okio-parent-0.*
okio-parent-0.5.0
okio-parent-0.6.0
okio-parent-0.6.1
okio-parent-0.7.0
okio-parent-0.8.0
okio-parent-0.9.0
okio-parent-1.*
okio-parent-1.0.0
okio-parent-1.0.1
okio-parent-1.10.0
okio-parent-1.11.0
okio-parent-1.12.0
okio-parent-1.13.0
okio-parent-1.14.0
okio-parent-1.14.1
okio-parent-1.15.0
okio-parent-1.16.0
okio-parent-1.17.0
okio-parent-1.17.1
okio-parent-1.17.2
okio-parent-1.17.3
okio-parent-1.17.4
okio-parent-1.17.5
okio-parent-1.2.0
okio-parent-1.3.0
okio-parent-1.4.0
okio-parent-1.5.0
okio-parent-1.6.0
okio-parent-1.7.0
okio-parent-1.8.0
okio-parent-1.9.0
okio-parent-2.*
okio-parent-2.0.0
okio-parent-2.1.0
okio-parent-2.2.0
okio-parent-2.2.1
parent-2.*
parent-2.3.0
parent-2.4.0
parent-2.4.3
parent-2.5.0
parent-2.6.0
parent-2.7.0
parent-2.8.0
parent-2.9.0
parent-3.*
parent-3.0.0
parent-3.0.0-alpha.1
parent-3.0.0-alpha.10
parent-3.0.0-alpha.11
parent-3.0.0-alpha.2
parent-3.0.0-alpha.3
parent-3.0.0-alpha.4
parent-3.0.0-alpha.5
parent-3.0.0-alpha.6
parent-3.0.0-alpha.7
parent-3.0.0-alpha.8
parent-3.0.0-alpha.9
parent-3.1.0
parent-3.2.0
parent-3.3.0

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-3635.json"