Denial of Service Vulnerability in Apache Commons Compress (libcommons-compress-java)
Summary
DEBIAN-CVE-2023-42503: Improper Input Validation, Uncontrolled Resource Consumption vulnerability in Apache Commons Compress in TAR parsing.This issue affects Apache Commons Compress: from 1.22 before 1.24.0. Affects libcommons-compress-java versions < 1.24.0-1. Fixed in 1.24.0-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Commons Compress is a library that provides support for working with various compression formats, including TAR, ZIP, and others. It is widely used in Java applications for handling compressed files. The library allows developers to read and write compressed data easily, making it a crucial component in many software projects. However, certain versions of this library are vulnerable to a specific issue that can lead to denial of service through improper input validation in TAR file parsing.
Vulnerability Detail
The vulnerability arises from improper input validation in the TAR parsing functionality of Apache Commons Compress. Specifically, it affects versions from 1.22 up to, but not including, 1.24.0. A third party can create a malformed TAR file by manipulating file modification time headers, which, when parsed, can cause excessive CPU consumption, leading to denial of service. The impacted fields include 'atime', 'ctime', 'mtime', and 'LIBARCHIVE.creationtime'. The parsing of these headers uses the BigDecimal class from the JDK, which has known algorithmic complexity issues when handling large numbers. This allows an attacker to craft a TAR file that takes an inordinate amount of time to process, exhausting CPU resources.
How To Fix
Minimum fixed version
1.24.0-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libcommons-compress-javaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid processing TAR files from untrusted sources or implement additional validation checks before parsing TAR files to mitigate the risk of denial of service.
Conclusion
The vulnerability in Apache Commons Compress poses a significant risk of denial of service due to improper input validation in TAR file parsing. Users are strongly advised to upgrade to the patched version to mitigate this risk. Additionally, employing Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for libcommons-compress-java →
FAQ
The vulnerability is a denial of service issue caused by improper input validation in the TAR parsing functionality of Apache Commons Compress.
Versions from 1.22 up to, but not including, 1.24.0 are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application against this vulnerability using the Vulert playground without any signup.
If exploited, this vulnerability can lead to denial of service, causing applications to become unresponsive due to excessive CPU usage.
Yes, upgrading to version 1.24.0 or later of the libcommons-compress-java package will resolve the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for libcommons-compress-java.
