CVE-2023-3635: Okio GzipSource unhandled exception Denial of Service

Modified

AliasesUBUNTU-CVE-2023-3635CGA-22m9-5h49-q62jCGA-26v4-h9wh-9cj4+170 more

Published 12-07-2023Last modified 23-10-2024

Vulnerability summary

CVE-2023-3635 is a high (CVSS 7.5) Signed to Unsigned Conversion Error vulnerability in squareup okio. EPSS estimates a 1.25% chance of exploitation in the next 30 days, higher than 69.5% of scored vulnerabilities. 1 public exploit is recorded.

Priority

Routine

Not severe (CVSS 5.9, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

7.5/10

010

High · v3.1 (NVD)

EPSS score

1.25%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits1reference

Advisory lineage

Upstream 0 · Downstream 0 · Related 8

CGA-3P56-C2M7-VC2Q CGA-5WCH-P264-WJVV CGA-7435-52PF-XMP5 CGA-774G-V4CR-J889 CGA-GVQR-M7RP-72VJ CGA-HP3C-4GWW-MMJF+2 more

Timeline

12-07-2023
PublishedVulnerability first disclosed.
23-10-2024
Last modifiedVulnerability information updated.

Description

GzipSource does not handle an exception that might be raised when parsing a malformed gzip buffer. This may lead to denial of service of the Okio client when handling a crafted GZIP archive, by using the GzipSource class.

CVSS metrics

6 scores · 6 sources · 1 version

v3.17.5

EPSS trend

Probability

1.25%

Chance of exploitation in the next 30 days

Percentile

70%

Versus all other CVEs

30-day change

No change 0.00 pp

From 1.25% on 05-10-2026

05-10-202604-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

1 found

referenceUnverified
Exploit Reference (research.jfrog.com)
Maturity: unknown

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard76 products

docker-selenium-standalone-chromeAll versions (No fix recorded)
druidAll versions (No fix recorded)
grpc-java-fips-1.56.0All versions (No fix recorded)
grpc-java-fips-1.56.0-m2All versions (No fix recorded)
hadoop-fips-3.3.6All versions (No fix recorded)

hadoop-fips-3.4.2All versions (No fix recorded)
hadoop-fips-3.5< 3.5.0-r12
knative-kafka-broker-1.17-dispatcher-loom< 1.17.3-r2 | < 1.17.3-r14
knative-kafka-broker-1.17-receiver-loom< 1.17.3-r14 | < 1.17.3-r2
s3proxy< 3.3.0-r1
s3proxy-fips< 3.3.0-r1
thingsboard< 3.7-r2
thingsboard-tb-js-executor< 3.7-r2
thingsboard-tb-mqtt-transport< 3.7-r2
thingsboard-tb-node< 3.7-r2
thingsboard-tb-web-ui< 3.7-r2
trino< 469-r0
trino-config< 469-r0
trino-oci-entrypoint< 469-r0
trino-plugin-ai-functions< 469-r0
trino-plugin-bigquery< 469-r0
trino-plugin-blackhole< 469-r0
trino-plugin-cassandra< 469-r0
trino-plugin-clickhouse< 469-r0
trino-plugin-delta-lake< 469-r0
trino-plugin-druid< 469-r0
trino-plugin-duckdb< 469-r0
trino-plugin-elasticsearch< 469-r0
trino-plugin-exasol< 469-r0
trino-plugin-exchange-filesystem< 469-r0
trino-plugin-exchange-hdfs< 469-r0
trino-plugin-faker< 469-r0
trino-plugin-functions-python< 469-r0
trino-plugin-geospatial< 469-r0
trino-plugin-google-sheets< 469-r0
trino-plugin-hive< 469-r0
trino-plugin-http-event-listener< 469-r0
trino-plugin-http-server-event-listener< 469-r0
trino-plugin-hudi< 469-r0
trino-plugin-iceberg< 469-r0
trino-plugin-ignite< 469-r0
trino-plugin-jmx< 469-r0
trino-plugin-kafka< 469-r0
trino-plugin-kafka-event-listener< 469-r0
trino-plugin-lakehouse< 469-r0
trino-plugin-ldap-group-provider< 469-r0
trino-plugin-loki< 469-r0
trino-plugin-mariadb< 469-r0
trino-plugin-memory< 469-r0
trino-plugin-ml< 469-r0
trino-plugin-mongodb< 469-r0
trino-plugin-mysql< 469-r0
trino-plugin-mysql-event-listener< 469-r0
trino-plugin-opa< 469-r0
trino-plugin-openlineage< 469-r0
trino-plugin-opensearch< 469-r0
trino-plugin-oracle< 469-r0
trino-plugin-password-authenticators< 469-r0
trino-plugin-pinot< 469-r0
trino-plugin-postgresql< 469-r0
trino-plugin-prometheus< 469-r0
trino-plugin-ranger< 469-r0
trino-plugin-redis< 469-r0
trino-plugin-redshift< 469-r0
trino-plugin-resource-group-managers< 469-r0
trino-plugin-session-property-managers< 469-r0
trino-plugin-singlestore< 469-r0
trino-plugin-snowflake< 469-r0
trino-plugin-spooling-filesystem< 469-r0
trino-plugin-sqlserver< 469-r0
trino-plugin-teradata-functions< 469-r0
trino-plugin-thrift< 469-r0
trino-plugin-tpcds< 469-r0
trino-plugin-tpch< 469-r0
trino-plugin-vertica< 469-r0
wavefront-proxy< 13.4-r4

Show all 76

Wolfi67 products

docker-selenium-standalone-chromeAll versions (No fix recorded)
druidAll versions (No fix recorded)
thingsboard< 3.7-r2
thingsboard-tb-js-executor< 3.7-r2
thingsboard-tb-mqtt-transport< 3.7-r2

Show all 67

Com.squareup.okio2 products

okio≥ 2.0.0-RC1, < 3.4.0 | < 1.17.6
okio-jvm≥ 2.0.0-RC1, < 3.4.0

Squareup1 product

okio≥ 0.5.0, < 1.17.6 | ≥ 2.0.0, < 3.4.0

Ubuntu1 product

okioAll versions (No fix recorded)

5 vendors · 147 products

References

13 links

research.jfrog.com/vulnerabilities/okio-gzip-source-unhandled-exception-dos-xray-523195/REPORTWEBExploitPatchThird Party Advisory
github.com/square/okio/commit/81bce1a30af244550b0324597720e4799281da7bREPORTFIXWEBPatch
ubuntu.com/security/CVE-2023-3635REPORT
www.cve.org/CVERecord?id=CVE-2023-3635REPORT
mvnrepository.comWEB
github.com/CVEProject/cvelistV5/tree/main/cves/2023/3xxx/CVE-2023-3635.jsonAdvisory
nvd.nist.gov/vuln/detail/CVE-2023-3635Advisory
github.com/square/okio/pull/1280WEB
github.com/square/okio/pull/1334WEB
github.com/square/okio/commit/b4fa875dc24950680c386e4b1c593660ce4f7839WEB

Show all 13 references