Detections
Analytics
SCA: security update for Snappier (GHSA-838x-pcvx-6p5w)
medium Tenable Cloud Security Plugin ID 412389
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- Snappier is a high performance C# implementation of the Snappy compression algorithm. This is a buffer
overrun vulnerability that can affect any user of Snappier 1.1.0. In this release, much of the code was
rewritten to use byte references rather than pointers to pinned buffers. This change generally improves
performance and reduces workload on the garbage collector. However, when the garbage collector performs
compaction and rearranges memory, it must update any byte references on the stack to refer to the updated
location. The .NET garbage collector can only update these byte references if they still point within the
buffer or to a point one byte past the end of the buffer. If they point outside this area, the buffer
itself may be moved while the byte reference stays the same. There are several places in 1.1.0 where byte
references very briefly point outside the valid areas of buffers. These are at locations in the code being
used for buffer range checks. While the invalid references are never dereferenced directly, if a GC
compaction were to occur during the brief window when they are on the stack then it could invalidate the
buffer range check and allow other operations to overrun the buffer. This should be very difficult for an
attacker to trigger intentionally. It would require a repetitive bulk attack with the hope that a GC
compaction would occur at precisely the right moment during one of the requests. However, one of the range
checks with this problem is a check based on input data in the decompression buffer, meaning malformed
input data could be used to increase the chance of success. Note that any resulting buffer overrun is
likely to cause access to protected memory, which will then cause an exception and the process to be
terminated. Therefore, the most likely result of an attack is a denial of service. This issue has been
patched in release 1.1.1. Users are advised to upgrade. Users unable to upgrade may pin buffers to a fixed
location before using them for compression or decompression to mitigate some, but not all, of these cases.
At least one temporary decompression buffer is internal to the library and never pinned. (CVE-2023-28638)
See Also
Plugin Details
Severity: Medium
ID: 412389
Version: Revision 1.7
Type: Local
Family: SCA Checks
Published: 1/23/2025
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Medium
Score: 5
Percentile: 94.66
Vendor
Vendor Severity: High
CVSS v2
Risk Factor: Medium
Base Score: 5.4
Temporal Score: 4
Vector: CVSS2#AV:N/AC:H/Au:N/C:N/I:N/A:C
CVSS Score Source: CVE-2023-28638
CVSS v3
Risk Factor: Medium
Base Score: 5.9
Temporal Score: 5.2
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 3/27/2023
Vulnerability Publication Date: 3/27/2023
Reference Information
CVE: CVE-2023-28638
cwe: CWE-119