CVE-2017-9434

What it actually does

Out-of-bounds read in the Inflator decompression filter within zinflate.cpp that can disclose adjacent memory contents.

Why it matters to the business

Applications relying on this library for decompression may leak sensitive memory data, increasing risk of information disclosure in cryptographic or data-processing workflows; widespread library use amplifies potential exposure across dependent systems.

How an attack unfolds

An attacker supplies specially crafted compressed input that triggers the Inflator filter to perform an out-of-bounds read, returning portions of adjacent memory to the caller without authentication or user interaction.

How to fix it

Upgrade affected packages to the listed fixed versions: cass-operator-fips and cass-operator-compat-fips to 1.18.2-r3; weidai11/cryptopp to commit 07dbcc3d9644b18e05c1776db2a57fe04d780965 or later. Rebuild and redeploy any dependent images or binaries after the update.

How to confirm the fix worked

Confirm the installed Crypto++ library version or commit hash matches a fixed release; run regression tests exercising the Inflator filter with boundary-case compressed streams; monitor build pipelines for the updated dependency.

Typical attack path

1. Identify an application or service that processes untrusted compressed data using the vulnerable Crypto++ Inflator
2. Craft a malicious input stream designed to cause the out-of-bounds read during decompression
3. Deliver the input via network, file, or API channel accepted by the target
4. Observe returned data or application behavior to extract leaked memory contents

How to detect it

Scan application logs and memory dumps for unexpected partial memory artifacts returned during decompression operations; review process crashes or sanitizer reports referencing zinflate.cpp; correlate with inbound compressed payloads from untrusted sources in historical traffic captures.

What your security team should do

• Prioritize upgrade of all Crypto++ instances to the fixed versions within standard change windows given the library's broad ecosystem use
• Review and inventory all products or containers pulling from weidai11/cryptopp or the listed Chainguard images
• Update dependency manifests and CI pipelines to enforce the patched commit or package version
• Test decompression paths with malformed inputs post-upgrade to confirm absence of the read behavior