Infinite Loop Denial of Service Vulnerability in libcommons-compress-java
Summary
CVE-2019-12402: The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite loop when faced with specially crafted inputs. Affects libcommons-compress-java across 2 version ranges.
< 1.18-3
>= 01b06d5ef5c5ac3bd651bedcfec7433231cea371, <= b95d5cde4c68640f886e3c6802384fae47408a37
Fixed in 1.18-3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libcommons-compress-java is a Java library that provides support for working with various compression and archive formats. It is commonly used in applications that need to compress or decompress files. This vulnerability affects versions 1.15 to 1.18 of the library. The vulnerability allows an attacker to create specially crafted archives that can trigger an infinite loop in the file name encoding algorithm used by the library. This can lead to a denial of service attack, causing the application using the library to become unresponsive or crash.
Vulnerability Detail
The file name encoding algorithm used internally in libcommons-compress-java versions 1.15 to 1.18 can get stuck in an infinite loop when processing certain inputs. This vulnerability can be exploited by an attacker who can control the file names inside an archive created by the library. By crafting malicious file names, the attacker can cause the algorithm to enter an infinite loop, consuming excessive CPU resources and potentially leading to a denial of service condition. The vulnerability has a CVSS score of 7.5, indicating a high severity.
How To Fix
Minimum fixed version
1.18-3
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libcommons-compress-javaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is necessary to apply the fix by upgrading to the patched version of libcommons-compress-java.
Conclusion
The libcommons-compress-java library versions 1.15 to 1.18 are vulnerable to an infinite loop denial of service attack. To mitigate this vulnerability, it is crucial to upgrade to version 1.18-3 or later of the library. Developers should promptly update their applications and ensure they are using the patched version. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for libcommons-compress-java →
FAQ
libcommons-compress-java is a Java library that provides support for compression and decompression of various archive formats.
Versions 1.15 to 1.18 of libcommons-compress-java are affected by this vulnerability.
This vulnerability can lead to a denial of service attack, causing the affected application to become unresponsive or crash.
To fix this vulnerability, upgrade to version 1.18-3 or later of libcommons-compress-java.
No, there is no known workaround. It is necessary to apply the fix by upgrading to the patched version of libcommons-compress-java.
Related vulnerabilities
Recent vulnerabilities recorded for libcommons-compress-java.
