GitHub Advisoryadvisory · Maven

GHSA-h436-432x-8fvx Apache Commons Compress vulnerable to denial of service due to infinite loop

MEDIUM Published 2019-03-14 Modified 2024-02-27 Official page ↗
Aliases
CVE-2018-1324
Ecosystem
Maven
Packages
org.apache.commons:commons-compress, com.liferay:com.liferay.portal.tools.bundle.support, io.takari:commons-compress
Severity
Moderate
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weaknesses
CWE-835
Reviewed
2020-06-16

Affected packages

• Maven org.apache.commons:commons-compress: >= 1.11, < 1.16 → fixed in 1.16 • Maven com.liferay:com.liferay.portal.tools.bundle.support: >= 3.2.7, < 3.7.4 → fixed in 3.7.4 • Maven io.takari:commons-compress: 1.12 (no fix yet)

Description

A specially crafted ZIP archive can be used to cause an infinite loop inside of Apache Commons Compress' extra field parser used by the ZipFile and ZipArchiveInputStream classes in versions 1.11 to 1.15. This can be used to mount a denial of service attack against services that use Compress' zip package.

Related

Alias · CVE (1)

  • CVE-2018-1324 A specially crafted ZIP archive can be used to cause an infinite loop inside of Apache Commons Compress' extra field parser used by the… vulnerability

Weakness · CWE (1)

  • CWE-835 Loop with Unreachable Exit Condition weakness

References