Denial of Service Vulnerability in Apache Commons Compress: Improper Input Validation in TAR Parsing
Summary
CVE-2023-42503: Improper Input Validation, Uncontrolled Resource Consumption vulnerability in Apache Commons Compress in TAR parsing.This issue affects Apache Commons Compress: from 1.22 before 1.24.0. Affects libcommons-compress-java versions >= 5183d0b08c0897e6f0c41a038487b7c795136425, < e52eabe9c0eb47b436e873ad7cb83fe737164dec. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Commons Compress is a widely used library that provides functionalities for working with various archive formats, including TAR files. It allows developers to create, read, and manipulate compressed files in a straightforward manner. The library is integral for applications that require file compression and decompression, making it a critical component in many software solutions. However, a recent vulnerability has been identified that affects versions from 1.22 to 1.24.0, which can lead to severe performance issues when processing specially crafted TAR files.
Vulnerability Detail
The vulnerability, identified as CVE-2023-42503, stems from improper input validation during the parsing of TAR files in Apache Commons Compress. A third party can exploit this vulnerability by creating a malformed TAR file with manipulated file modification time headers. When these files are processed, the parsing can lead to uncontrolled resource consumption, resulting in a denial of service (DoS) condition. The issue arises from the use of the BigDecimal class in Java, which has known performance issues when handling large numbers. Attackers can craft headers with excessively long fractions or large exponent notation, causing the parsing process to consume significant CPU resources and potentially leading to application downtime.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If upgrading is not immediately possible, a temporary workaround is to implement input validation checks on the TAR files before processing them. This can include checking the format of the modification time headers and rejecting files that contain suspiciously large numbers or unusual formatting.
Conclusion
CVE-2023-42503 represents a significant risk for applications using Apache Commons Compress, particularly those that handle TAR files. It is crucial for developers and system administrators to upgrade to version 1.24.0 or later to safeguard against potential denial of service attacks. Implementing input validation can serve as a temporary measure while transitioning to the updated version.
See every vulnerability recorded for libcommons-compress-java →
FAQ
CVE-2023-42503 is a vulnerability in Apache Commons Compress that allows attackers to create malformed TAR files, leading to denial of service through excessive CPU consumption.
Versions from 1.22 to 1.24.0 are affected by this vulnerability.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading your manifest file, you can check for vulnerabilities without needing to install any software.
Implement input validation checks on TAR files to reject suspicious files until you can upgrade to a secure version.
The CVSS score for CVE-2023-42503 is 5.5, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for libcommons-compress-java.
