CVE-2023-39743

What it actually does

Access violation during bz3_decode_block execution in LZMA decompression leads to memory corruption and potential process crash.

Why it matters to the business

Service availability can be disrupted by remote crashes in affected compression handling components, with moderate operational impact due to long-public exploit availability.

How an attack unfolds

An attacker supplies specially crafted LZMA input that reaches the vulnerable decode path in libbz3.c, triggering an access violation during block processing and causing denial of service.

How to fix it

Update sap/cloud-pysec to commit 0c554829c8fecd6dec77c1c3af2bbf316eba8c60 or later to resolve the access violation in bz3_decode_block.

How to confirm the fix worked

Verify the deployed code contains commit 0c554829c8fecd6dec77c1c3af2bbf316eba8c60 and test decompression of known triggering inputs to confirm absence of the access violation.

Typical attack path

1. Identify a target process or service that uses the vulnerable lrzip-next LZMA decoder
2. Craft and deliver malicious compressed data via network or file input
3. Trigger bz3_decode_block execution on the malformed input
4. Induce access violation resulting in process termination or instability

How to detect it

Review application and system logs for segmentation faults or access violations originating from libbz3.c or bz3_decode_block during LZMA processing; correlate with inbound compressed file handling.

What your security team should do

• Apply the fixed commit immediately given public exploit availability
• Scan all dependencies for older lrzip-next LZMA usage and prioritize upgrades
• Implement input validation and sandboxing around decompression routines until patched
• Monitor for process crashes correlated with LZMA handling