CVE-2019-12402: Denial of Service in Apache Commons Compress
Summary
CVE-2019-12402: Denial of Service in Apache Commons Compress. Affects org.apache.commons:commons-compress versions >= 1.15, < 1.19. Fixed in 1.19. How to fix ↓
Also tracked for
- libcommons-compress-java · Debian:11
The same CVE-2019-12402 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Commons Compress is a Java library that provides functionality for working with various archive formats, such as ZIP, TAR, and GZIP. It is widely used in many applications for compressing and decompressing files. The vulnerability identified as CVE-2019-12402 affects versions 1.15 to 1.18 of Apache Commons Compress. This vulnerability arises from a flaw in the file name encoding algorithm used internally by the library. When presented with specially crafted inputs, the algorithm can enter an infinite loop, resulting in a denial of service (DoS) attack. An attacker with the ability to control the file names within an archive created by Compress can exploit this vulnerability to cause the application using the library to become unresponsive or crash.
Vulnerability Detail
The vulnerability in Apache Commons Compress arises from an issue in the file name encoding algorithm used by the library. When encountering certain inputs, the algorithm can get stuck in an infinite loop, leading to a DoS attack. This vulnerability can be exploited by an attacker who can control the file names within an archive created by Compress. By crafting specially designed file names, the attacker can cause the application using the library to consume excessive resources or crash, resulting in a denial of service. The severity of this vulnerability is rated as HIGH with a CVSS score of 7.5.
How To Fix
Minimum fixed version
1.19
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is necessary to apply the fix by upgrading to a patched version of Apache Commons Compress.
Conclusion
The vulnerability identified as CVE-2019-12402 in Apache Commons Compress can lead to a denial of service (DoS) attack when an attacker can control the file names within an archive created by the library. Upgrading to version 1.19 or later of Apache Commons Compress is necessary to fix this vulnerability. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.commons:commons-compress →
FAQ
Apache Commons Compress is a Java library that provides functionality for working with various archive formats, such as ZIP, TAR, and GZIP.
Versions 1.15 to 1.18 of Apache Commons Compress are affected by this vulnerability.
This vulnerability can be exploited by an attacker to cause a denial of service (DoS) attack, resulting in the application becoming unresponsive or crashing.
To fix this vulnerability, it is recommended to upgrade to version 1.19 or later of Apache Commons Compress.
No, there is no known workaround for this vulnerability. It is necessary to apply the fix by upgrading to a patched version of Apache Commons Compress.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.commons:commons-compress.
