Find, fix and prevent vulnerabilities in your code.

Overview

org.lz4:lz4-java is a Java port of the LZ4 compression algorithm and the xxHash hashing algorithm.

Affected versions of this package are vulnerable to Out-of-bounds Read due to the use of the insecure LZ4_decompress_fast in the underlying lz4 library, which lacks bounds checks. An attacker can cause denial of service or access sensitive memory contents by providing specially crafted compressed input.

Workaround

• Applications using LZ4Factory.nativeInstance() in conjunction with .fastDecompressor() can switch to .safeInstance() or .safeDecompressor().
• Applications using LZ4Factory.unsafeInstance(), .fastestInstance() or .fastestJavaInstance() can switch to .safeInstance().

Notes

• The official org.lz4:lz4-java library has not been patched and the project is discontinued.

• org.lz4:lz4-java:1.8.1 relocates the pacakge to at.yawk.lz4:lz4-java, which is a community-maintained fork of the library that fixes this vulnerability.

Remediation

Upgrade org.lz4:lz4-java to version 1.8.1 or higher.

References

• GitHub Commit
• GitHub Release
• Vulnerability Report