Denial of Service Vulnerability in libcommons-compress-java: Infinite Loop in ZIP Archive Parsing
Summary
DEBIAN-CVE-2018-1324: A specially crafted ZIP archive can be used to cause an infinite loop inside of Apache Commons Compress' extra field parser used by the ZipFile and ZipArchiveInputStream classes in versions 1.11 to 1.15. Affects libcommons-compress-java versions < 1.13-2. Fixed in 1.13-2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libcommons-compress-java is a Java library that provides support for reading and writing various archive formats, including ZIP files. It is widely used in applications that require file compression and decompression functionalities. The library's ability to handle ZIP files makes it a critical component for many Java applications, but it is susceptible to vulnerabilities that can be exploited to disrupt service.
Vulnerability Detail
A specially crafted ZIP archive can trigger an infinite loop in the Apache Commons Compress library's extra field parser, specifically within the ZipFile and ZipArchiveInputStream classes. This vulnerability affects versions 1.11 to 1.15 of the library and can be exploited to launch a denial of service (DoS) attack against services utilizing the zip package. The infinite loop can cause the application to become unresponsive, leading to service outages and potential data loss.
How To Fix
Minimum fixed version
1.13-2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libcommons-compress-javaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid processing untrusted or specially crafted ZIP files until the library is updated. Implementing input validation to check the integrity of ZIP files before processing can also mitigate the risk.
Conclusion
The libcommons-compress-java library is vulnerable to a denial of service attack due to an infinite loop triggered by specially crafted ZIP files. It is crucial to update to the patched version 1.13-2 to mitigate this risk. Until an update can be applied, implement workarounds to safeguard your applications.
See every vulnerability recorded for libcommons-compress-java →
FAQ
The vulnerability is an infinite loop caused by specially crafted ZIP archives, leading to potential denial of service.
Versions 1.11 to 1.15 of libcommons-compress-java are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, avoid processing untrusted ZIP files and implement input validation as a temporary measure.
More information can be found in the CVE database and the official Debian security advisories.
References
Related vulnerabilities
Recent vulnerabilities recorded for libcommons-compress-java.
