CVE-2018-11771: Vulnerability in org.apache.commons:commons-compress

Background

The org.apache.commons:commons-compress package is a popular open-source library used for working with compressed files in Java applications. It provides functionality for reading and writing various compression formats, including ZIP archives. This vulnerability affects versions 1.7 to 1.17 of the library. The package is commonly used in a wide range of applications and services that handle compressed files.

Vulnerability Detail

The vulnerability (CVE-2018-11771) arises when the read method of Apache Commons Compress 1.7 to 1.17's ZipArchiveInputStream is used to read a specially crafted ZIP archive. In certain cases, the read method fails to return the correct end-of-file (EOF) indication after reaching the end of the stream. This issue becomes critical when combined with a java.io.InputStreamReader, as it can result in an infinite stream. Attackers can exploit this vulnerability to launch denial-of-service attacks against services that utilize the Compress' zip package.

Workaround

As a workaround, developers can implement input stream size limits or timeouts to prevent potential denial-of-service attacks. This can be achieved by setting appropriate constraints on the input stream used with ZipArchiveInputStream. Here's an example of how to set a timeout of 5 seconds using the java.util.zip.ZipInputStream class:

import java.util.zip.ZipInputStream;
import java.io.FileInputStream;
import java.io.IOException;

public class ZipReader {
    public static void main(String[] args) throws IOException {
        FileInputStream fis = new FileInputStream("path/to/archive.zip");
        ZipInputStream zis = new ZipInputStream(fis);
        zis.setTimeout(5000);
        // Rest of the code
    }
}

Conclusion

In conclusion, the org.apache.commons:commons-compress package is vulnerable to a denial-of-service attack due to a flaw in the read method of ZipArchiveInputStream. Upgrading to version 1.18 or higher of the package is recommended to fix the vulnerability. Developers can also implement input stream size limits or timeouts as a temporary workaround. For further assistance and support on vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for org.apache.commons:commons-compress →

FAQ