Denial of Service Vulnerability in Apache Commons Compress - libcommons-compress-java
Summary
CVE-2018-11771: When reading a specially crafted ZIP archive, the read method of Apache Commons Compress 1.7 to 1.17's ZipArchiveInputStream can fail to return the correct EOF indication after the end of the stream has been reached. Affects libcommons-compress-java versions < 1.18-1. Fixed in 1.18-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Commons Compress is a library that provides a simple API for working with various compression formats, including ZIP, TAR, and others. It is widely used in Java applications for file compression and decompression tasks. The library is designed to be efficient and easy to use, but it has been found to contain a vulnerability that can lead to denial of service attacks when handling specially crafted ZIP archives.
Vulnerability Detail
The vulnerability, identified as CVE-2018-11771, arises from the read method of ZipArchiveInputStream in Apache Commons Compress versions 1.7 to 1.17. When processing a specially crafted ZIP archive, this method may fail to indicate the end of the stream correctly. If this incorrect EOF indication is combined with a java.io.InputStreamReader, it can result in an infinite stream. This behavior can be exploited by attackers to create a denial of service condition in applications that utilize the Compress library's ZIP functionality, potentially leading to resource exhaustion and service unavailability.
How To Fix
Minimum fixed version
1.18-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libcommons-compress-javaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, consider implementing input validation to restrict the types of ZIP files that can be processed by your application. Additionally, monitor the application for unusual behavior that may indicate an ongoing denial of service attack.
Conclusion
CVE-2018-11771 is a significant vulnerability in the Apache Commons Compress library that can lead to denial of service attacks. It is crucial for users of the libcommons-compress-java package to upgrade to version 1.18-1 or later to mitigate this risk. Utilizing tools like Vulert can help in monitoring and identifying vulnerabilities in your applications.
See every vulnerability recorded for libcommons-compress-java →
FAQ
CVE-2018-11771 is a vulnerability in Apache Commons Compress that can lead to denial of service due to incorrect EOF handling in ZIP file processing.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading your manifest file like package-lock.json, you can check for vulnerabilities without requiring code access.
The CVSS score for CVE-2018-11771 is 5.5, indicating a moderate level of severity.
Exploitation of this vulnerability can lead to denial of service, causing applications to become unresponsive and potentially exhausting system resources.
Yes, you can implement input validation and monitor for unusual application behavior as a temporary workaround until an upgrade can be performed.
Related vulnerabilities
Recent vulnerabilities recorded for libcommons-compress-java.
