# CVE-2023-3635: Okio Signed to Unsigned Conversion Error vulnerability

> CVE-2023-3635 (GitHub advisory GHSA-w33c-445m-f8w7) is a medium-severity vulnerability with a CVSS 3.1 base score of 5.9, classed as Signed to Unsigned Conversion Error (CWE-195), in com.squareup.okio:okio (Maven) and com.squareup.okio:okio-jvm (Maven). Fixed versions: com.squareup.okio:okio 3.4.0 or 1.17.6; com.squareup.okio:okio-jvm 3.4.0.

Canonical page: https://cveminer.com/vulnerabilities/CVE-2023-3635

| Field | Value |
| --- | --- |
| CVE | CVE-2023-3635 |
| GHSA | GHSA-w33c-445m-f8w7 |
| Severity | Medium |
| CVSS 3.1 | 5.9 `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H` (GitHub Advisory Database) |
| CWE | CWE-195 Signed to Unsigned Conversion Error; CWE-681 Incorrect Conversion between Numeric Types |
| EPSS | 1.25% (higher than 68% of CVEs) |
| CISA KEV | Not listed |
| SSVC | exploitation none, automatable no, technical impact partial |
| Published | 12 Jul 2023 |
| Modified | 23 Oct 2024 |

## Description

GzipSource does not handle an exception that might be raised when parsing a malformed gzip buffer. This may lead to denial of service of the Okio client when handling a crafted GZIP archive, by using the GzipSource class.

## Affected packages

| Package | Ecosystem | PURL | Vulnerable versions | Fixed in |
| --- | --- | --- | --- | --- |
| com.squareup.okio:okio | Maven | `pkg:maven/com.squareup.okio/okio` | >= 2.0.0-RC1, < 3.4.0; < 1.17.6 | 3.4.0, 1.17.6 |
| com.squareup.okio:okio-jvm | Maven | `pkg:maven/com.squareup.okio/okio-jvm` | >= 2.0.0-RC1, < 3.4.0 | 3.4.0 |

## Fix commits

- Patch: https://github.com/square/okio/commit/81bce1a30af244550b0324597720e4799281da7b
- Patch: https://github.com/square/okio/commit/b4fa875dc24950680c386e4b1c593660ce4f7839
- Pull request: https://github.com/square/okio/pull/1280
- Pull request: https://github.com/square/okio/pull/1334

## Questions

**What is the GHSA ID for CVE-2023-3635?**

GitHub tracks CVE-2023-3635 as GHSA-w33c-445m-f8w7.

**What is the CVSS score of CVE-2023-3635?**

CVE-2023-3635 has a CVSS 3.1 base score of 5.9 (Medium), vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H.

**Which versions are affected by CVE-2023-3635?**

com.squareup.okio:okio (Maven): >= 2.0.0-RC1, < 3.4.0; < 1.17.6. com.squareup.okio:okio-jvm (Maven): >= 2.0.0-RC1, < 3.4.0.

**How do I fix CVE-2023-3635?**

Upgrade each package to its fixed version: com.squareup.okio:okio 3.4.0 or 1.17.6; com.squareup.okio:okio-jvm 3.4.0. The fix is in commits 81bce1a and b4fa875 and pull requests #1280 and #1334.

**What is the Package URL (PURL) for CVE-2023-3635?**

The affected packages' PURLs are pkg:maven/com.squareup.okio/okio and pkg:maven/com.squareup.okio/okio-jvm.

**Is CVE-2023-3635 exploited in the wild?**

CISA's Known Exploited Vulnerabilities catalog doesn't list CVE-2023-3635. That means no confirmed exploitation has been catalogued, not that it is safe to leave unpatched. CISA's SSVC assessment rates exploitation as "none". EPSS estimates a 1.25% chance of exploitation in the next 30 days, higher than 68% of CVEs.

## References

- https://github.com/square/okio/pull/1280 (fix)
- https://github.com/square/okio/pull/1334 (fix)
- https://github.com/square/okio/commit/81bce1a30af244550b0324597720e4799281da7b (fix)
- https://github.com/square/okio/commit/b4fa875dc24950680c386e4b1c593660ce4f7839 (fix)
- https://nvd.nist.gov/vuln/detail/CVE-2023-3635 (advisory)
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/3xxx/CVE-2023-3635.json (advisory)
- https://github.com/advisories/GHSA-w33c-445m-f8w7 (advisory)
- https://github.com/square/okio (package)
- https://github.com/square/okio/blob/master/CHANGELOG.md#version-1176
- https://research.jfrog.com/vulnerabilities/okio-gzip-source-unhandled-exception-dos-xray-523195
- https://mvnrepository.com

---

Source: CVEminer (https://cveminer.com/vulnerabilities/CVE-2023-3635), compiled from OSV (GitHub advisory), GitHub Advisory Database, OSV (CVE record), CVE.org, CISA KEV catalog. OSV and GitHub Advisory Database content is licensed CC BY 4.0.