GitHub Advisoryadvisory · Maven

GHSA-53x6-4x5p-rrvv Denial of Service in Apache Commons Compress

HIGH Published 2019-10-11 Modified 2021-06-15 Official page ↗
Aliases
CVE-2019-12402
Ecosystem
Maven
Packages
org.apache.commons:commons-compress, io.github.1tchy.java9modular.org.apache.commons:commons-compress
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-835
Reviewed
2019-09-30

Affected packages

• Maven org.apache.commons:commons-compress: >= 1.15, < 1.19 → fixed in 1.19 • Maven io.github.1tchy.java9modular.org.apache.commons:commons-compress: 1.18.1 (no fix yet)

Description

The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite loop when faced with specially crafted inputs. This can lead to a denial of service attack if an attacker can choose the file names inside of an archive created by Compress.

Related

Alias · CVE (1)

  • CVE-2019-12402 The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite loop when faced with… vulnerability

Weakness · CWE (1)

  • CWE-835 Loop with Unreachable Exit Condition weakness

References