Denial of Service Vulnerability in Apache Commons Compress (CVE-2018-1324)
Summary
CVE-2018-1324: A specially crafted ZIP archive can be used to cause an infinite loop inside of Apache Commons Compress' extra field parser used by the ZipFile and ZipArchiveInputStream classes in versions 1.11 to 1.15. Affects libcommons-compress-java across 2 version ranges.
< 1.13-2
>= ff38bf57378c7cae8617b3c8df692a5ffbe7b83f, <= 01b06d5ef5c5ac3bd651bedcfec7433231cea371
Fixed in 1.13-2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Commons Compress is a widely used library that provides functionalities for working with various compression formats, including ZIP files. It is utilized in many Java applications for handling compressed data efficiently. The library's extra field parser, which processes additional metadata in ZIP files, is crucial for ensuring proper extraction and handling of compressed content. However, certain versions of this library are susceptible to a vulnerability that can lead to denial of service attacks.
Vulnerability Detail
CVE-2018-1324 is a vulnerability that arises from the handling of specially crafted ZIP archives by the extra field parser in Apache Commons Compress. This flaw exists in versions 1.11 to 1.15 of the library, allowing an attacker to create a ZIP file that causes an infinite loop when processed by the ZipFile and ZipArchiveInputStream classes. The consequence of this vulnerability is a denial of service, as the affected service can become unresponsive, potentially leading to significant downtime and disruption of service for users.
How To Fix
Minimum fixed version
1.13-2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libcommons-compress-javaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If an immediate upgrade is not feasible, consider implementing input validation to reject ZIP files that contain suspicious or malformed extra fields. This can help mitigate the risk of triggering the infinite loop until the library can be updated.
Conclusion
CVE-2018-1324 represents a significant risk for applications using vulnerable versions of Apache Commons Compress. By understanding the nature of this vulnerability and taking appropriate action to upgrade or implement workarounds, developers can protect their applications from potential denial of service attacks.
See every vulnerability recorded for libcommons-compress-java →
FAQ
CVE-2018-1324 is a vulnerability in Apache Commons Compress that allows specially crafted ZIP files to cause an infinite loop, leading to denial of service.
Versions 1.11 to 1.15 of Apache Commons Compress are affected by this vulnerability.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software by analyzing your manifest file like package-lock.json.
The CVSS score of CVE-2018-1324 is 5.5, indicating a moderate severity level.
Implement input validation to reject suspicious ZIP files as a temporary workaround until you can upgrade the library.
Related vulnerabilities
Recent vulnerabilities recorded for libcommons-compress-java.
