PT-2023-5202 · Apache+2 · Apache Commons Compress+2

Yakov Shafranovich · Publicado 2023-09-11 · Atualizado 2026-05-18 · CVE-2023-42503

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Apache Commons Compress versions 1.22 through 1.23

Description The issue is related to uncontrolled resource consumption due to insufficient input validation when processing TAR archive headers. This can be exploited by a remote attacker to cause a denial of service. The estimated number of potentially affected devices is not specified.

Recommendations For Apache Commons Compress versions 1.22 through 1.23, update to version 1.24.0 or later to resolve the issue. As a temporary workaround, consider restricting the processing of TAR archives from untrusted sources to minimize the risk of exploitation.

Correção

DoS

Improper Resource Release

Resource Exhaustion

RCE

Enumeração de Fraquezas

CWE-404

CWE-400

CWE-20

Identificadores relacionados

BDU:2023-05808

CLEANSTART-2026-SQ91016

CLEANSTART-2026-WK99982

CVE-2023-42503

GHSA-CGWF-W82Q-5JRR

Produtos afetados

Apache Commons Compress

Debian

Red Os

Referências · 159

• https://github.com/apache/commons-compress · Nota
• https://github.com/apache/commons-compress/commit/aae38bfb820159ae7a0b792e779571f6a46b3889 · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-SQ91016.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-WK99982.json · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-42583 · Nota de Segurança
• https://twitter.com/oss_security/status/1702103504972898478 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-24970 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2026-5588 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2025-58057 · Nota de Segurança
• https://security-tracker.debian.org/tracker/CVE-2023-42503 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2024-6763 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2025-25193 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-27821 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-24308 · Nota
• https://osv.dev/vulnerability/CVE-2026-33871 · Nota