PT-2018-3633 · Apache · Apache Commons Compress

Published 2018-06-05 · Updated 2022-04-18 · CVE-2018-11771

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Apache Commons Compress versions 1.7 through 1.17

Description The issue is related to the read method of Apache Commons Compress's ZipArchiveInputStream, which can fail to return the correct EOF indication after the end of the stream has been reached when reading a specially crafted ZIP archive. This can lead to an infinite stream when combined with a java.io.InputStreamReader, potentially allowing an attacker to mount a denial of service attack against services that use Compress' zip package.

Recommendations For Apache Commons Compress versions 1.7 through 1.17, consider updating to a version where this issue is fixed, as the current version can lead to a denial of service attack. As a temporary workaround, consider restricting the use of the ZipArchiveInputStream class until a patch is available. Avoid using the ZipArchiveInputStream class in combination with a java.io.InputStreamReader to minimize the risk of exploitation.

Fix

DoS

Infinite Loop

Weakness Enumeration

CWE-835

Related Identifiers

BDU:2021-01453

CVE-2018-11771

GHSA-HRMR-F5M6-M9PQ

MGASA-2019-0001

Affected Products

Apache Commons Compress

References · 50

• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/UJ7GKBUCVEHQVGOXIOT6EWCRVDZJMHGK · Vendor Advisory
• https://oracle.com/security-alerts/cpujan2022.html · Patch
• https://cve.org/CVERecord?id=CVE-2018-11771 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/FLKWBUZ7KVAJV6VZAY2UYW5JIEVMRT2R · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-11771 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2019-0001.html · Security Note
• https://security-tracker.debian.org/tracker/CVE-2018-11771 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-11771 · Security Note
• https://osv.dev/vulnerability/CVE-2018-11771 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-01453 · Security Note
• https://osv.dev/vulnerability/GHSA-hrmr-f5m6-m9pq · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-11771 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2019-0001 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-11771 · Vendor Advisory
• https://github.com/apache/commons-compress · Note