CVE-2023-22895 bzip2 allows attackers to cause a denial of service via a large file that triggers an integer overflow
Attackers can cause denial of service in applications using the Rust bzip2 crate by providing a large file that triggers an integer overflow.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-22895?
CVE-2023-22895 is a high-severity vulnerability in n/a, published on 10 Jan 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The bzip2 crate before 0.4.4 for Rust allow attackers to cause a denial of service via a large file that triggers an integer overflow in mem.rs. NOTE: this is unrelated to the https://crates.io/crates/bzip2-rs product.
Weakness: CWE-190
Which versions are affected by CVE-2023-22895?
3 open source packages ship an affected version, including bzip2. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
bzip2 crates.io | All versions | 0.4.4 |
bzip2 crates.io | All versions | 0.4.4 |
bzip2 crates.io | From 0.0.0-0 | 0.4.4 |
Linux distribution packages (3)
python-cramjam openSUSE:Tumbleweed | All versions | 2.9.1-1.3 |
rage-encryption openSUSE:Tumbleweed | All versions | 0.9.0+0-4.1 |
wasm-pack openSUSE:Tumbleweed | All versions | 0.10.3~0-2.1 |
Products include Bzip2 Project Bzip2.
How do I fix CVE-2023-22895?
Upgrade bzip2 to 0.4.4 or later.
Is CVE-2023-22895 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-22895 exists.
Sources
Also known as DEBIAN-CVE-2023-22895, GHSA-96jv-r488-c2rj, RUSTSEC-2023-0004, UBUNTU-CVE-2023-22895, openSUSE-SU-2024:12610-1, openSUSE-SU-2024:12614-1 and 2 more.