8.2High
lz4_flex: Decompression can leak information from uninitialized memory or reused output buffer
PSeitz lz4_flex; Red Hat Logging Subsystem for Red Hat OpenShift 6.2; Red Hat Logging Subsystem for Red Hat OpenShift 6.4; Red Hat Logging Subsystem for Red Hat OpenShift 6.5
lz4_flex is a pure Rust implementation of LZ4 compression/decompression. In versions 0.11.5 and below, and 0.12.0, decompressing invalid LZ4 data can leak sensitive information from uninitialized memory or from previous decompression operations. The library …