Skip to content
OpenAdvisories
Medium · 5.9 Public exploit CVE-2023-3635 EUVD-2023-2158GHSA-w33c-445m-f8w7

Okio GzipSource unhandled exception Denial of Service

Published Jul 12, 2023 · Updated Oct 23, 2024 · Assigned by JFROG

Package: com.squareup.okio:okio Package: com.squareup.okio:okio-jvm Package: docker-selenium-standalone-chrome Package: okio Package: thingsboard Package: thingsboard-tb-js-executor Package: thingsboard-tb-mqtt-transport Package: thingsboard-tb-node Package: thingsboard-tb-web-ui Package: trino Package: trino-config Package: trino-oci-entrypoint Package: trino-plugin-ai-functions Package: trino-plugin-bigquery Package: trino-plugin-blackhole Package: trino-plugin-cassandra Package: trino-plugin-clickhouse Package: trino-plugin-delta-lake Package: trino-plugin-druid Package: trino-plugin-duckdb Package: trino-plugin-elasticsearch Package: trino-plugin-exasol Package: trino-plugin-exchange-filesystem Package: trino-plugin-exchange-hdfs Package: trino-plugin-faker Package: trino-plugin-functions-python Package: trino-plugin-geospatial Package: trino-plugin-google-sheets Package: trino-plugin-hive Package: trino-plugin-http-event-listener Package: trino-plugin-http-server-event-listener Package: trino-plugin-hudi Package: trino-plugin-iceberg Package: trino-plugin-ignite Package: trino-plugin-jmx Package: trino-plugin-kafka Package: trino-plugin-kafka-event-listener Package: trino-plugin-lakehouse Package: trino-plugin-ldap-group-provider Package: trino-plugin-loki Package: trino-plugin-mariadb Package: trino-plugin-memory Package: trino-plugin-ml Package: trino-plugin-mongodb Package: trino-plugin-mysql Package: trino-plugin-mysql-event-listener Package: trino-plugin-opa Package: trino-plugin-openlineage Package: trino-plugin-opensearch Package: trino-plugin-oracle Package: trino-plugin-password-authenticators Package: trino-plugin-pinot Package: trino-plugin-postgresql Package: trino-plugin-prometheus Package: trino-plugin-ranger Package: trino-plugin-redis Package: trino-plugin-redshift Package: trino-plugin-resource-group-managers Package: trino-plugin-session-property-managers Package: trino-plugin-singlestore Package: trino-plugin-snowflake Package: trino-plugin-spooling-filesystem Package: trino-plugin-sqlserver Package: trino-plugin-teradata-functions Package: trino-plugin-thrift Package: trino-plugin-tpcds Package: trino-plugin-tpch Package: trino-plugin-vertica Package: wavefront-proxy Ecosystem: Maven Ecosystem: Ubuntu Ecosystem: Wolfi

Description

GzipSource does not handle an exception that might be raised when parsing a malformed gzip buffer. This may lead to denial of service of the Okio client when handling a crafted GZIP archive, by using the GzipSource class.

Affected products

VendorProductAffectedFixed
— com.squareup.okio:okio 0.5.0 – < 1.0.0, 1.0.0 – < 1.17.6, 2.0.0 – < 3.0.0, 3.0.0 – < 3.4.0 1.0.0

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 okio No fix yet —
Ubuntu 26.04 LTS okio No fix yet —
Ubuntu 25.10 okio No fix yet —
Ubuntu 24.04 LTS okio No fix yet —
Ubuntu 22.04 LTS okio No fix yet —
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 20.04 LTS okio No fix yet —
Ubuntu 18.04 LTS okio No fix yet —

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling docker-selenium-standalone-chrome No fix yet —
Wolfi rolling thingsboard +4 3.7-r2 —
Wolfi rolling trino +58 469-r0 —
Wolfi rolling wavefront-proxy 13.4-r4 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
Maven com.squareup.okio:okio >= 2.0.0-RC1, < 3.4.0 3.4.0 GHSA-w33c-445m-f8w7
Maven com.squareup.okio:okio < 1.17.6 1.17.6 GHSA-w33c-445m-f8w7
Maven com.squareup.okio:okio-jvm >= 2.0.0-RC1, < 3.4.0 3.4.0 GHSA-w33c-445m-f8w7

Advisories 9

References