Vulnerability · Published Jan 4, 2024 · Assigned by cloudflare

CVE-2023-6992Memory corruption issues is Cloudflare zlib implementation

Medium 4.0

In plain English

A medium-severity improper input validation in zlib from Cloudflare. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.0Medium

Exploit odds (30 days)0.2%top 85.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Cloudflare version of zlib library was found to be vulnerable to memory corruption issues affecting the deflation algorithm implementation (deflate.c). The issues resulted from improper input validation and heap-based buffer overflow. A local attacker could exploit the problem during compression using a crafted malicious file potentially leading to denial of service of the software. Patches: The issue has been patched in commit 8352d10 https://github.com/cloudflare/zlib/commit/8352d108c05db1bdc5ac3bdf834dad641694c13c . The upstream repository is not affected.

Affected packages & fixed versions

Ecosystem	Package	Advisory
Alpine:v3.20	zlib	ALPINE-CVE-2023-6992
Alpine:v3.21	zlib	ALPINE-CVE-2023-6992
Alpine:v3.22	zlib	ALPINE-CVE-2023-6992
Alpine:v3.23	zlib	ALPINE-CVE-2023-6992
Alpine:v3.24	zlib	ALPINE-CVE-2023-6992

Affected products (as reported)

Vendor	Product	Versions
Cloudflare	zlib	0 – before 8352d10

Weakness: CWE-20, CWE-122, CWE-126 · Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L

References

https://github.com/cloudflare/zlib product
https://github.com/cloudflare/zlib/security/advisories/GHSA-vww9-j87r-4cqh vendor-advisory