CVE catalog

CVE-2023-22895

rust-bzip2: CVE-2023-22895

Severity: Medium · CVSS 4CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Published: Jan 10, 2023, 1:15:10 AM UTC
Source: [NVD] · [CVE record]
EPSS: 1.25% · Oct 25, 2026

The bzip2 crate before 0.4.4 for Rust allow attackers to cause a denial of service via a large file that triggers an integer overflow in mem.rs. NOTE: this is unrelated to the https://crates.io/crates/bzip2-rs product.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	rust-bzip2	sid	`0.6.1-1`	fixed
Debian	rust-bzip2	forky	`0.6.1-1`	fixed
Debian	rust-bzip2	trixie	`0.4.4-1`	fixed
Debian	rust-bzip2	bookworm	`0.4.4-1`	fixed
Opensuse	wasm-pack	tumbleweed	`0.10.3~0-2.1`	fixed
Opensuse	rage-encryption	tumbleweed	`0.9.0+0-4.1`	fixed
Opensuse	python-cramjam	tumbleweed	`2.9.1-1.3`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	rust-bzip2	source	sid	`0.4.4-1`	not yet assigned	Not reported	[1029158]
Debian	rust-bzip2	source	forky	`0.4.4-1`	not yet assigned	Not reported	[1029158]
Debian	rust-bzip2	source	trixie	`0.4.4-1`	not yet assigned	Not reported	[1029158]
Debian	rust-bzip2	source	bookworm	`0.4.4-1`	not yet assigned	Not reported	[1029158]
Opensuse	wasm-pack	rpm	tumbleweed	`0.10.3~0-2.1`	Not reported	OPENSUSE-SU-2024:12616-1	Not reported
Opensuse	rage-encryption	rpm	tumbleweed	`0.9.0+0-4.1`	Not reported	OPENSUSE-SU-2024:12610-1	Not reported
Opensuse	python-cramjam	rpm	tumbleweed	`2.9.1-1.3`	Not reported	OPENSUSE-SU-2025:15094-1	Not reported

[Debian bug #1029158]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]