{"action":"Upgrade bzip2 to 0.4.4 or later.","affected":[{"fixed":"0.4.4","introduced":"0"}],"component":"bzip2","cve_ids":["CVE-2023-22895"],"ecosystem":"crates.io","epss":0.01247,"exploited":false,"fixed_versions":["0.4.4"],"ghsa_id":"GHSA-96jv-r488-c2rj","id":"tcs_01M5KEW6PRSXAAMV8W5PP2HWRR","modified_at":"2023-11-08T04:11:39.404864Z","published_at":"2023-01-10T03:30:29Z","references":["https://osv.dev/vulnerability/GHSA-96jv-r488-c2rj","https://nvd.nist.gov/vuln/detail/CVE-2023-22895","https://github.com/alexcrichton/bzip2-rs/pull/86","https://github.com/alexcrichton/bzip2-rs/commit/90c9c182cd5a5ebc75810aebd89b347a7bdf590b","https://crates.io/crates/bzip2/versions","https://github.com/alexcrichton/bzip2-rs","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MI5SVRSGKBWB2JGDLDVIFY5ZQVDZP6I7","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SQK57GGXJX3AH7KF6S7S3N7JC5QOYUQ7","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UUK2JO25PPA6XBREKJRBLRCD22LKIOLO","https://rustsec.org/advisories/RUSTSEC-2023-0004.html"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-96jv-r488-c2rj","url":"https://osv.dev/vulnerability/GHSA-96jv-r488-c2rj"}],"summary":"bzip2 allows attackers to cause a denial of service via a large file that triggers an integer overflow"}