Not rated
CVE-2018-1324 A specially crafted ZIP archive can be used to cause an infinite loop inside of Apache Commons Compress' extra field…
Description
A specially crafted ZIP archive can be used to cause an infinite loop inside of Apache Commons Compress' extra field parser used by the ZipFile and ZipArchiveInputStream classes in versions 1.11 to 1.15. This can be used to mount a denial of service attack against services that use Compress' zip package.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache Commons Compress | Versions not published |
References
- 1040549 www.securitytracker.com
- [dev] 20180316 [CVE-2018-1324] Apache Commons Compress denial of service vulnerability lists.apache.org
- 103490 www.securityfocus.com
- [pulsar-commits] 20190416 [GitHub] [pulsar] one70six opened a new issue #4057: Security Vulnerabilities - Black Duck Scan - Pulsar v.2.3.1 lists.apache.org
- [creadur-dev] 20190530 [Discuss] RAT-244 - update to language level 1.7 due to CVE issues in RAT lists.apache.org
- [beam-issues] 20200421 [jira] [Closed] (BEAM-3873) Current version of commons-compress is DOS vulnerable CVE-2018-1324 lists.apache.org
- www.oracle.com www.oracle.com
Timeline
- Published
- Last modified
Other CVEs of Apache Commons Compress
The 10 CVEs of Apache Commons Compress →
CVE-2024-25710
Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Commons Compress.This issue affects…
8.1
High
CVE-2024-26308
Allocation of Resources Without Limits or Throttling vulnerability in Apache Commons Compress.This issue affects…
Not rated
CVE-2023-42503
Improper Input Validation, Uncontrolled Resource Consumption vulnerability in Apache Commons Compress in TAR…
Not rated
CVE-2021-36090
When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally…
Not rated