Denial of Service Vulnerability in libcommons-compress-java: Infinite Loop Risk
Summary
DEBIAN-CVE-2019-12402: The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite loop when faced with specially crafted inputs. Affects libcommons-compress-java versions < 1.18-3. Fixed in 1.18-3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libcommons-compress-java is a Java library that provides support for working with various compression formats, including ZIP, TAR, and others. It is widely used in applications that require file compression and decompression functionalities. The library is integral for developers who need to handle compressed files efficiently. However, certain versions of this library are vulnerable to a specific issue that can lead to denial of service under certain conditions.
Vulnerability Detail
The vulnerability arises from the file name encoding algorithm used internally in Apache Commons Compress versions 1.15 to 1.18. When faced with specially crafted inputs, this algorithm can enter an infinite loop, causing the application to hang and become unresponsive. This situation can be exploited by an attacker who can control the file names within an archive created by the library, leading to a denial of service attack. The affected versions do not handle specific edge cases properly, which allows for this infinite loop to occur.
How To Fix
Minimum fixed version
1.18-3
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libcommons-compress-javaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If an immediate update is not possible, consider implementing input validation to sanitize file names before processing them with the library. This can help mitigate the risk of triggering the infinite loop.
Conclusion
The libcommons-compress-java library has a vulnerability that can lead to denial of service due to an infinite loop caused by specific file name inputs. It is crucial to update to version 1.18-3 or later to mitigate this risk. For those unable to update immediately, implementing input validation can serve as a temporary workaround.
See every vulnerability recorded for libcommons-compress-java →
FAQ
Versions 1.15 to 1.18 of libcommons-compress-java are affected by this vulnerability.
The vulnerability can lead to a denial of service, causing applications to hang and become unresponsive when processing specially crafted file names.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
Yes, the patched version is 1.18-3. Updating to this version will resolve the vulnerability.
Implement input validation to sanitize file names before processing them with the library as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for libcommons-compress-java.
