oss-security - [CVE-2018-1324] Apache Commons Compress denial of service vulnerability

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <87woycifgl.fsf@v45346.1blu.de>
Date: Fri, 16 Mar 2018 09:37:14 +0100
From: Stefan Bodewig <bodewig@...che.org>
To: Commons Developers List <dev@...mons.apache.org>, user@...mons.apache.org,
    announce@...che.org
CC: security@...mons.apache.org, oss-security@...ts.openwall.com
Subject: [CVE-2018-1324] Apache Commons Compress denial of service vulnerability

CVE-2018-1324: Apache Commons Compress denial of service vulnerability

Severity: Low

Vendor:
The Apache Software Foundation

Versions Affected:
Apache Commons Compress 1.11 to 1.15

Description:
A specially crafted ZIP archive can be used to cause an infinite loop
inside of Compress' extra field parser used by the ZipFile and
ZipArchiveInputStream classes.  This can be used to mount a denial of
service attack against services that use Compress' zip package.

Mitigation:
Commons Compress users should upgrade to 1.16 or later

Credit:
This issue was discovered by Luis Filipe Nassif.

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.